Multiple cross-site request forgery (CSRF) vulnerabilities in the Views UI implementation in the Views module 5.x before 5.x-1.8 and 6.x before 6.x-2.11 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable all Views or (2) disable all Views.


Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive download system info file plugin system settings plugin options settings generate a new key reset all options change notifications settings management page settings comment form settings manage subscriptions > mass update settings manage subscriptions > add a new subscription update subscription delete Subscription.


An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5 all versions starting from 14.5.0 before 14.5.3 all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.


phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)


The

Login/Signup

Popup

Waitlist

Woocommerce

Back

in

stock

notifier

and

Side

Cart

Woocommerce

(Ajax)

WordPress

plugins

by

XootiX

are

vulnerable

to

Cross-Site

Request

Forgery

via

the

function

found

in

the

file

which

makes

it

possible

for

attackers

to

update

arbitrary

options

on

a

site

that

can

be

used

to

create

an

administrative

user

account

and

grant

full

privileged

access

to

a

compromised

site.

This

affects

versions

in

Login/Signup

Popup

versions

in

Waitlist

Woocommerce

Back

in

stock

notifier

and

versions

in

Side

Cart

Woocommerce

(Ajax).


On all versions of 16.1.x 15.1.x 14.1.x 13.1.x 12.1.x and 11.6.x of F5 BIG-IP (fixed in 17.0.0) a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping traceroute and WOM diagnostics. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password (perform a connection test) disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142) and test a rollback with attacker-specified parameters.


CodeIgniter4 is the 4.x branch of CodeIgniter a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability but users will still need to code as these after upgrading to v4.1.9. Otherwise the CSRF protection may be bypassed. If auto-routing is enabled check the request method in the controller method before processing. If auto-routing is disabled either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.


Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.


Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.


A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 2.0 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.


In FileCloud before 21.3 file upload is not protected against Cross-Site Request Forgery (CSRF).


TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.


A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.


Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions Content Downloads Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors.


Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at /goform/WifiExtraSet.


A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at /goform/SysToolReboot.


A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g. archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.


A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.


A CWE-942: Permissive Cross-domain Policy with Untrusted Domains vulnerability exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB HMIBSCEA53D1EDS HMIBSCEA53D1EDM HMIBSCEA53D1EDL HMIBSCEA53D1ESS HMIBSCEA53D1ESM HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)


IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.


YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.


Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition.


Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.


A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an authenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.


A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. These actions could include modifying the system configuration and deleting accounts.


The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts which makes it easier for remote attackers to avoid detection of cross-site request forgery (CSRF) attacks as demonstrated by a redirect from the cgi-bin/wireless.cgi script.


The implementation of Cross-Origin Resource Sharing (CORS) in WebKit as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33 includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.


Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php and might allow remote attackers to hijack the authentication of certain users via a (2) ADD or (3) DELETE action to enrolments/step2.php.


Cross-site request forgery (CSRF) vulnerability in Linksys WRT160N wireless router hardware 1 and firmware 1.02.2 allows remote attackers to hijack the authentication of other users for unspecified requests via unknown vectors as demonstrated using administrator privileges and actions.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

SquirrelMail

and

earlier

and

NaSMail

before

allow

remote

attackers

to

hijack

the

authentication

of

unspecified

victims

via

features

such

as

send

message

and

change

preferences

related

to

src/addressbook.php

src/compose.php

src/folders.php

src/options.php

src/search.php

and

src/vcard.php.


Cross-site request forgery (CSRF) vulnerability in the administrative console in the Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.39 6.1 before 6.1.0.29 and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3 a module for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a user or (2) delete a certain type of administrative-bypass rule.


Cross-site request forgery (CSRF) vulnerability in the Your_account module in CMSphp 0.21 allows remote attackers to hijack the authentication of administrators for requests that change an administrator password via the pseudo pwd and uid parameters in an admin_info_user_verif action.


Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login new_password and confirm_password parameters in a preferences action.


Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for (1) requests that change the password via the username parameter to config/changepw.php or (2) stop a virtual machine via the stop_vmname parameter to hardstopvm.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1 and other 2.4.x 2.5.x and pre-release 2.6.x versions allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.


Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters.


Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages change permissions or change group memberships as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element a related issue to CVE-2009-1339.


Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages as demonstrated by a URL for a save script in the SRC attribute of an IMG element a related issue to CVE-2009-1434.


Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11 as used in vbDrupal before 5.17.0 allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.


Multiple cross-site request forgery (CSRF) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to hijack the authentication of (1) administrator or (2) device users for requests that create new administrative users or have unspecified other impact.


Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM BladeCenter including the BladeCenter H with BPET36H 54 allow remote attackers to hijack the authentication of administrators as demonstrated by a power-off request to the private/blade_power_action script.


Cross-site request forgery (CSRF) vulnerability in Beltane before 2.3.11 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in index.aas in Application Access Server (A-A-S) 2.0.48 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary programs via a command job (2) stop services via a setservice job or (3) terminate processes via a killprocess job.


Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password (2) upload applications and perform unspecified other administrative actions as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.


Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x 7.0 7.01 7.02x 7.03 7.03HP1a and 8.0 allows remote attackers to insert e-mail forwarding rules and modify unspecified other configuration settings as arbitrary users via unknown vectors.


Bugzilla 3.2.1 3.0.7 and 3.3.2 when running under mod_perl calls the srand function at startup time which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.


Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7 3.0 before 3.0.7 3.2 before 3.2.1 and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.


Cross-site request forgery (CSRF) vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1 6.2.5 6.2.6 6.2.7 before 6.2.7.7 6.3 before 6.3.0.4 and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to execute commands and modify appliance preferences as arbitrary users via a logout action.


Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown the server (2) send ping packets (3) enable network services (4) configure a proxy server and (5) modify other settings via parameters in the query string.


Multiple cross-site request forgery (CSRF) vulnerabilities in SemanticScuttle before 0.91 allow remote attackers to (1) hijack the authentication of administrators via unknown vectors or (2) hijack the authentication of arbitrary users via vectors involving the profile page.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

the

HP

Embedded

Web

Server

(EWS)

on

HP

LaserJet

Printers

Edgeline

Printers

and

Digital

Senders

allow

remote

attackers

to

hijack

the

intranet

connectivity

of

arbitrary

users

for

requests

that

print

documents

via

unknown

vectors

modify

the

network

configuration

via

a

NetIPChange

request

to

hp/device/config_result_YesNo.html/config

or

change

the

password

via

the

Password

and

ConfirmPassword

parameters

to

hp/device/set_config_password.html/config.


Multiple cross-site request forgery (CSRF) vulnerabilities in the manage_users handler in admin/index.php in Falt4 CMS (aka Falt4 Extreme) RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the (1) edit and (2) edit_now actions.


Cross-site request forgery (CSRF) vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1 6.2.5 6.2.6 6.2.7 before 6.2.7.7 6.3 before 6.3.0.4 and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to modify appliance preferences as arbitrary users via unspecified vectors.


scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v0 parameters which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the \My Account\ feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists.


Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages as demonstrated by a URL for a save script in the ACTION attribute of a FORM element in conjunction with a call to the submit method in the onload attribute of a BODY element. NOTE: this issue exists because of an insufficient fix for CVE-2009-1339.


Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php or (3) send arbitrary email to arbitrary users in the email action to admin.php.


Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors a different vulnerability than CVE-2009-4077.


Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to tvserver/user/user.do (2) shutdown a virtual machine (3) start a virtual machine (4) restart a virtual machine or (5) schedule an activity.


Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors a different vulnerability than CVE-2009-4076.


Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account.


Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a blog via the add_blog action (2) approve a comment via the approve_comment action (3) change administrator information including the password via the admin_opt action and (4) delete a blog via the delete action.


Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete orders via an orders-delete action to admin.php and possibly (2) delete products or (3) delete pages via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users including a new administrator via an adduser action in the editusers module in index.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete web pages via a p-delete action to admin.php and possibly (2) delete products or (3) delete orders via unspecified vectors. NOTE: some of these details are obtained from third party information.


Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions and possibly zForum allow remote attackers to hijack the authentication of victims for requests that change passwords and other unspecified requests via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action.


Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account (2) add user accounts or (3) modify user accounts to have administrator privileges.


Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action. NOTE: some of these details are obtained from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password (2) force an admin logout (3) change the visibility of posts (4) remove links and (5) change the name fields of a blog.


IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 120657.


IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107.


A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCve76872.


OXID eShop Community Edition before 6.0.0 RC2 (development) 4.10.x before 4.10.5 (maintenance) and 4.9.x before 4.9.10 (legacy) Enterprise Edition before 6.0.0 RC2 (development) 5.2.x before 5.2.10 (legacy) and 5.3.x before 5.3.5 (maintenance) and Professional Edition before 6.0.0 RC2 (development) 4.9.x before 4.9.10 (legacy) and 4.10.x before 4.10.5 (maintenance) allow remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) if the following pre-conditions are met: (1) the attacker knows which shop is presently used by the client (2) the attacker knows the exact time when the customer will add product items to the cart (3) the attacker knows which product items are already in the cart (has to know their article IDs) and (4) the attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.


A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0 and MRD-315 MRD-355 MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user making it possible for an attacker to trick a user into making a malicious request to the server.


An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability.


A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCuz88421 CSCuz91356 CSCve56308.


Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page allowing the attacker to gain admin privileges in the system.


Windows DVD Maker in Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 and Windows Vista SP2 does not properly parse crafted .msdvd files which allows attackers to obtain information to compromise a target system aka \Windows DVD Maker Cross-Site Request Forgery Vulnerability.\


Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp.


in

ConnectWise

Manage

is

vulnerable

to

Cross-Site

Request

Forgery

(CSRF)

as

demonstrated

by

changing

an

e-mail

address

setting.


The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request Forgery (CSRF) attack potentially allowing an attacker to execute administrative operations provided the targeted user has an active session and is induced to trigger a malicious request.


Cross-site request forgery (CSRF) vulnerability in Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier and Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3) CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM TS-PTCAM TS-PTCAM/POE TS-WLC2 TS-WLCE TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.


A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.


The dotCMS administration panel versions 3.7.1 and earlier are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.


Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.


A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web interface of the affected software. More Information: CSCvb70021. Known Affected Releases: 11.5(1.11007.2).


Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3 17.x before 17.1 12 LTS before 12.12 LTS and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element related to tiki-assignuser.php.


AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the \/ossim/report/wizard_email.php\ script. Besides offering an export via a local download the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality it is vulnerable to Cross-Site Request Forgery attacks.


A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The application does not sufficiently verify requests making it susceptible to cross-site request forgery. This may allow an attacker to execute unauthorized code resulting in changes to the configuration of the device.


Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3 17.x before 17.1 12 LTS before 12.12 LTS and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element related to tiki-objectpermissions.php. For example an attacker could assign administrator privileges to every unauthenticated user of the site.


Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks XSS attacks click-jacking and MIME based attacks.


D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated as demonstrated by changing the Security option from WPA2 to None or changing the hiddenSSID parameter SSID parameter or a security-option password.


A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests if this component is configured. This includes creating new privileged credentials resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.


A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.


A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CSRF) attacks to occur when an otherwise-unauthorized cross-site request is sent from a browser the server has previously authenticated.


A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions OnCell 5104-HSDPA OnCell 5104-HSPA and OnCell 5004-HSPA. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request which could allow an attacker to modify the configuration of the device.


A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery (CSRF) attacks. An attacker could exploit this vulnerability by forcing the user's browser to perform any action authorized for that user. Cisco Bug IDs: CSCvc90280.


In

WordPress

before

there

is

cross-site

request

forgery

(CSRF)

in

Press

This

(wp-admin/includes/class-wp-press-this.php)

leading

to

excessive

use

of

server

resources.

The

CSRF

can

trigger

an

outbound

HTTP

request

for

a

large

file

that

is

then

parsed

by

Press

This.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvc91800. Known Affected Releases: 11.5(0) 11.6.


A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE all versions prior to 4.0.14 and AirLink Raven XT all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

the

addAction

and

purgeAction

functions

in

ViMbAdmin

allow

remote

attackers

to

hijack

the

authentication

of

logged

administrators

to

add

an

administrator

user

via

a

crafted

POST

request

to

<vimbadmin

directory>/application/controllers/DomainController.php

remove

an

administrator

user

via

a

crafted

GET

request

to

<vimbadmin

change

an

administrator

password

via

a

crafted

POST

request

to

<vimbadmin

add

a

mailbox

via

a

crafted

POST

request

to

<vimbadmin

directory>/application/controllers/MailboxController.php

delete

a

mailbox

via

a

crafted

POST

request

to

<vimbadmin

archive

a

mailbox

address

via

a

crafted

GET

request

to

<vimbadmin

directory>/application/controllers/ArchiveController.php

add

an

alias

address

via

a

crafted

POST

request

to

<vimbadmin

or

remove

an

alias

address

via

a

crafted

GET

request

to

<vimbadmin

directory>/application/controllers/AliasController.php.


A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the Device Manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the Device Manager web interface and with the privileges of the user. Cisco Bug IDs: CSCvc88811.


Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID (2) change the Wi-Fi password or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi.


NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintended authenticated action in the user interface.


EMC RSA Archer 5.4.1.3 5.5.3.1 5.5.2.3 5.5.2 5.5.1.3.1 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privileged attacker may potentially exploit the vulnerability to execute unauthorized requests on behalf of the victim using the authenticated user's privileges.


The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the \incoming mail\ whitelist setting via a Cross-site request forgery (CSRF) vulnerability.


Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.


An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the \index.php?pg=password.change\ endpoint. This allows an attacker to change the password of another user's HelpSpot account.


Request Tracker (RT) 4.x before 4.0.25 4.2.x before 4.2.14 and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.


Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users as demonstrated by admin/add_user.lua admin/change_user_prefs.lua admin/delete_user.lua and admin/password_reset.lua.


Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.


An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05 and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes and saving modified configuration.


A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.


Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application and are susceptible to a cross-site request forgery (CSRF) attack.


Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the admin password (2) reboot the device or (3) possibly have unspecified other impact via crafted requests to CGI programs.


A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.


Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user or to remove the authorization configuration preventing legitimate access to Jenkins.


Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID thereby possibly capturing them. Additionally this functionality did not require POST requests be used thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.


Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.


GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID thereby possibly capturing them. Additionally this functionality did not require POST requests be used thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.


Poll SCM Plugin was not requiring requests to its API be sent via POST thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation the plugin specifically adds a permission to be able to use this functionality and this issue undermines that permission.


The Periodic Backup Plugin did not perform any permission checks allowing any user with Overall/Read access to change its settings trigger backups restore backups download backups and also delete all previous backups via log rotation. Additionally the plugin was not requiring requests to its API be sent via POST thereby opening itself to Cross-Site Request Forgery attacks.


The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.


Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the Demo application is not enabled by default.


The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability.


The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities.


** DISPUTED ** An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host cross-site request forgery can be used to change settings in the inverters (for example issuing a POST request to change the user password). All Sunny Explorer settings available to the authenticated user are also available to the attacker. (In some cases this also includes changing settings that the user has no access to.) This may result in complete compromise of the device. NOTE: the vendor reports that exploitation is unlikely because Sunny Explorer is used only rarely. Also only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.


Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi related to the lack of anti-CSRF tokens.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view. NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.


PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vision 2017 or greater to mitigate this vulnerability.


A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.


An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who navigates to an attacker controlled page to install or delete an application on the device. Note: The cross-site request forgery is a systemic issue across all other functionalities of the device.


HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services.


An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.


Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can (1) create new administrator user accounts and take over the entire application (2) create regular user accounts or (3) change configuration parameters such as tax rates and the enable/disable status of PayPal payment modules.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

Ignite

Realtime

Openfire

allow

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

change

a

password

via

a

crafted

request

to

user-password.jsp

add

users

via

a

crafted

request

to

user-create.jsp

edit

server

settings

or

disable

SSL

on

the

server

via

a

crafted

request

to

server-props.jsp

or

add

clients

via

a

crafted

request

to


Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.


Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8 Horde Groupware before 5.2.11 and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php (2) SQL queries via the sql parameter to admin/sqlshell.php or (3) PHP code via the php parameter to admin/phpshell.php.


Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A TG862A and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users.


Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal when the OSF Import module is enabled allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.


Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10 8.7.x before 8.7.11 Patch 2 and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.


Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11 2.7.x before 2.7.11 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.


Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3 4.0 before CR4 4.5 before CR5 and 5.0 before CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote attackers to hijack the authentication of users with the \administer ncip providers\ permission for requests that alter NCIP providers via a crafted request.


Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11 2.7.x before 2.7.11 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.


Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 7.0 through 7.0.0.9 and 7.0 Feature Pack 8 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password (2) change the network policy or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.


Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5 10.0.2.x before 10.0.2.7 iFix4 and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations as demonstrated by modifying network settings.


Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.


Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.


Cloud Foundry Runtime cf-release before 216 UAA before 2.5.2 and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.


Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints and obtain sensitive information via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.


Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 6.x-2.x before 6.x-2.8 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

includes/campaignmonitor_lists.admin.inc

in

the

Campaign

Monitor

module

for

Drupal

allow

remote

attackers

to

hijack

the

authentication

of

users

for

requests

that

enable

list

subscriptions

via

a

request

to

admin/config/services/campaignmonitor/lists/%/enable

or

disable

list

subscriptions

via

a

request

to

admin/config/services/campaignmonitor/lists/%/disable.

NOTE:

this

refers

to

an

issue

in

an

independently

developed

Drupal

module

and

NOT

an

issue

in

the

Campaign

Monitor

software

itself

(described

on

the

campaignmonitor.com

web

site).


Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) continue or (2) delete an ongoing import via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793) 1.3(0.876) 1.4(0.109) 2.0(0.147) and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users aka Bug ID CSCus09940.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products (2) ratings or (3) categories via unspecified vectors.


eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation modification and deletion of users appointments and employees.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the \kwresearch admin site keywords\ permission for requests that (1) create (2) delete or (3) set priorities to keywords via unspecified vectors.


Cross-site

request

forgery

(CSRF)

vulnerability

in

in

B.A.S

before

allows

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

add

administrator

accounts

via

certain

vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) create (2) delete or (3) alter invoices via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption (2) deleteCache (3) deleteCssAndJsCache or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.


Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd.


Cross-site request forgery (CSRF) vulnerability in tracking_code.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that disable tracking codes via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01 Documentum Administrator through 7.2 Documentum Digital Assets Manager through 6.5SP6 Documentum Web Publishers through 6.5SP7 and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the authentication of arbitrary users. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2518.


Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the \access node template\ permission for requests that delete node templates via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts aka Bug ID CSCus97494.


Cross-site

request

forgery

(CSRF)

vulnerability

in

IBM

Leads

before

before

before

through

before

and

before

allows

remote

authenticated

users

to

hijack

the

authentication

of

customer

accounts.


Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users aka Bug ID CSCuj62924.


Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9 2.6.x before 2.6.7 2.7.x before 2.7.4 and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.


Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM) and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances allows remote attackers to hijack the authentication of arbitrary users aka Bug ID CSCuo99753.


Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.


Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9 2.6.x before 2.6.7 2.7.x before 2.7.4 and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.


IBM Leads 7.x 8.1.0 before 8.1.0.14 8.2 8.5.0 before 8.5.0.7.3 8.6.0 before 8.6.0.8.1 9.0.0 through 9.0.0.4 9.1.0 before 9.1.0.6.1 and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.


The navigator.sendBeacon implementation in Mozilla Firefox before 37.0 Firefox ESR 31.x before 31.6 and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site a similar issue to CVE-2014-8638.


Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7 6.2.1 before 6.2.1.1 IF5 7.0 before FP4 and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users aka \Exchange Cross-Site Request Forgery Vulnerability.\


Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token as demonstrated by a crafted HTML page that creates a new administrator account.


Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that (1) delete modules via the delete_module parameter (2) deactivate modules via the deactivate_module parameter (3) activate modules via the activate_module parameter (4) delete users via the delete_user parameter (5) deactivate users via the deactivate_user parameter (6) activate users via the activate_user parameter (7) activate themes via the set_theme parameter (8) deactivate themes via the set_theme parameter (9) delete themes via the delete parameter (10) deactivate events (user registration or email activation) via the deactivate_notification parameter (11) activate events via the activate_notification parameter (12) delete events via the delete_notification parameter (13) deactivate language settings via the deactivate_language parameter (14) activate language settings via the activate_language parameter (15) delete language settings via the delete_language parameter or (16) activate or deactivate the autologin feature for a user via a crafted maintenance request.


Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the \edit gd infinite scroll settings\ permission for requests that delete settings via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.


Cross-site request forgery (CSRF) vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete user role matching rules via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of certain users for requests that (1) delete a batch job record or (2) execute a task via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable (2) disable or (3) delete a report via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) deploy or (2) delete an .htaccess file via unspecified vectors.


Cross-site

request

forgery

(CSRF)

vulnerability

in

in

Ektron

Content

Management

System

(CMS)

before

(Build

allows

remote

attackers

to

hijack

the

authentication

of

content

administrators

for

requests

that

delete

content

via

a

delete

action.


Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the \node_invite_can_manage_invite\ permission for requests that re-enable node invitations via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.


Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10 4.2.x before 4.2.13.3 4.3.x before 4.3.13.1 and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) restore (2) publish or (3) unpublish a pattern via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) enable or (2) disable modules or (3) change variables via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for (1) hidden form elements or (2) status messages via unspecified vectors related to \report administration.\


The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and obtain sensitive information via a crafted HTTP request.


Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authentication of users for requests that cause an unspecified impact via the id parameter to project.php (2) hijack the authentication of users for requests that cause an unspecified impact via the group_id parameter to group.php (3) hijack the authentication of users for requests that delete statuses via the status_id parameter to status.php (4) hijack the authentication of users for requests that delete severities via the severity_id parameter to severity.php (5) hijack the authentication of users for requests that cause an unspecified impact via the priority_id parameter to priority.php (6) hijack the authentication of users for requests that delete the operating system via the os_id parameter to os.php (7) hijack the authentication of users for requests that delete databases via the database_id parameter to database.php or (8) hijack the authentication of users for requests that delete sites via the site_id parameter to sites.php.


Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.


Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.


Cross-site

request

forgery

(CSRF)

vulnerability

in

in

the

management

web

interface

in

Alcatel-Lucent

OmniSwitch

and

with

firmware

and

allows

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

create

users

via

a

crafted

request.


Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands as demonstrated by a door-unlock command.


Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7 1.6.x before 1.6.4 and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.


Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching (3) DNS Inject or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist.


Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.


Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.


MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow cross-site request forgery.


Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.


The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework allowing accounts to be connected without user intent user interaction or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.


Cross-site request forgery (CSRF) vulnerability in bmc/admin.php in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a delete_user action.


Cross-site request forgery (CSRF) vulnerability in the del_block function in modules/Admin/block.php in Nuked-Klan 1.7.5 and earlier and 1.7 SP4.2 allows remote attackers to delete arbitrary \blocks\ via a link with a modified bid parameter in a del_block op on the block page in index.php.


Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site request forgery (CSRF) vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user such as changing usernames and passwords via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19 when Link to off-site Avatar or bbcode (IMG) are enabled allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array related to (a) libraries/common.lib.php (b) session.inc.php and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.


The Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses predictable URLs for the spam classification of each message which allows remote attackers to cause Panda to classify arbitrary messages as spam via a web page that contains IMG tags with the predictable URLs. NOTE: this issue could also be regarded as a cross-site request forgery (CSRF) vulnerability.


Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.


Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51 and util.php in 5.x before 5.03 allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.


Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter (2) IP/Port Filtering via formFilter (3) Port Forwarding via formPortFw (4) Wireless Access Control via admin/formWlAc (5) Wi-Fi Protected Setup via formWsc (6) URL Blocking Filter via formURL (7) Domain Blocking Filter via formDOMAINBLK and (8) IP Address ACL Filter via admin/formACL in goform/ different vectors than CVE-2012-1921.


Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name.


Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an editpage action or (4) add a categorie via the blog module.


Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action.


** DISPUTED ** The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations.


Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php (2) delete an administrator via a request to auth/admin/adminprocess.php (3) add an event via a request to engine/new_event.php or (4) delete an event via a request to phpagenda/.


Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via the user id number to admin/user/delete; (2) delete pages via the page id number to admin/page/delete; delete the (3) images or (4) themes directory via the directory name to admin/plugin/file_manager/delete and possibly other directories; or (5) logout the user via a request to admin/login/logout.


Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100) also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100) allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter related to a \command-injection vulnerability.\


Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrator accounts via a member_new action to my_admin/admin1_members.php or (2) modify the default site title via a save action to my_admin/admin1_configuration.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.


Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action as demonstrated by changing the password.


Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code possibly related to improper \flood control.\


Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of administrators for requests that add a new page via a request to admin/pages-new-save.


Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module (2) delete news via a delete action in the news module or (3) delete newsletters via a delete action in the newsletters module.


Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.


Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts.


Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2 when mod_perl is used allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.


Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38 5.0x before 5.07 and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script.


Multiple cross-site request forgery (CSRF) vulnerabilities on the eAccess Pocket WiFi (aka GP02) router before 2.00 with firmware 11.203.11.05.168 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.


Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8 3.7.x and 4.0.x before 4.0.4 and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.


Cross-site request forgery (CSRF) vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings parameters.


Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 6.2 through 7.5 as used in SmartCloud Control Desk Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.


SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipityplugin_to_conf parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).


Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action.


Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote attackers to hijack the authentication of administrators for requests that (1) insert XSS sequences or (2) send messages to clients.


Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving \submitting saved results to a node.\


Multiple cross-site request forgery (CSRF) vulnerabilities in the Node Hierarchy module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to hijack the authentication of administrators for requests that change a node hierarchy position via an (1) up or (2) down action.


Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444 as used in Red Hat Enterprise Messaging Realtime and Grid (MRG) 2.0 allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add delete or modify sensitive information as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.


** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor who states that it is resultant from CVE-2012-2129: \the exploit code simply uses the XSS hole to extract a valid CSRF token.\


Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user account or (2) reconfigure the state of the FTP service as demonstrated by a request to usermanager/users/modify.


Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.


Cross-site request forgery (CSRF) vulnerability in the account-creation panel in IBM InfoSphere Guardium 8.2 and earlier when the CSRF filtering (aka csrf_status) feature is disabled allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier and WebSphere MQ - Managed File Transfer 7.5 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI.


Cross-site request forgery (CSRF) vulnerability in Microdasys before 3.5.1-B708 as used in Bloxx Web Filtering before 5.0.14 and other products allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences a different vulnerability than CVE-2012-2564.


Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators aka Bug ID CSCty46684.


Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; (2) create a user or (3) create a sub user via a sub_accounts action in the home module to USERS/index.php; or (4) change profile information via an edit action in the profile module to USERS/index.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allow remote attackers to hijack the authentication of arbitrary users for requests that send course messages.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

in

allow

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

conduct

SQL

injection

attacks

via

the

or

parameter.


Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.


Cross-site request forgery (CSRF) vulnerability in PHPJabbers Vacation Rental Script allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a create action in the AdminUsers module to index.php.


The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.


Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that (1) add an agent via an addagent action or (2) modify an agent.


Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar (3) zip or (4) gzip commands a different issue than CVE-2012-2982.


Cross-site request forgery (CSRF) vulnerability in the web-management interface in the fabric interconnect (FI) component in Cisco Unified Computing System (UCS) allows remote attackers to hijack the authentication of arbitrary users aka Bug ID CSCtg20755.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

ownCloud

before

allow

remote

attackers

to

hijack

the

authentication

of

arbitrary

users

for

requests

that

use

addBookmark.php

delBookmark.php

or

editBookmark.php

in

bookmarks/ajax/;

calendar/delete.php

calendar/edit.php

calendar/new.php

calendar/update.php

event/delete.php

event/edit.php

event/move.php

event/new.php

import/import.php

settings/setfirstday.php

settings/settimeformat.php

share/changepermission.php

share/share.php

or

share/unshare.php

in

calendar/ajax/;

or

in

apps/;

or

administrators

for

requests

that

use

changepassword.php

creategroup.php

createuser.php

disableapp.php

enableapp.php

lostpassword.php

removegroup.php

removeuser.php

setlanguage.php

setloglevel.php

setquota.php

or

togglegroups.php

in

settings/ajax/.


Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add delete or modify sensitive information as demonstrated by adding an administrator account via an add action to admin/accounts/add/.


Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action.


Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15 and 4.0.6 and other versions before 4.0.8 allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks.