VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 251 of 286
  • CVE-2015-2680Mar 23, 2015
    Genixcms
    Genixcms
    risk 0.00cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.

  • CVE-2015-2676Mar 23, 2015
    Asus
    RT-G32
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.

  • CVE-2015-2350Mar 19, 2015
    Mikrotik
    Routeros
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.

  • CVE-2015-2334Mar 18, 2015
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2015-2293Mar 17, 2015
    Yoast
    Wordpress Seo
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users…

  • CVE-2014-6214Mar 13, 2015
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2015-1874Mar 9, 2015
    WordPress
    Contact Form DB
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a…

  • CVE-2015-0895Mar 7, 2015
    WordPress
    All In One Wp Security And Firewall
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.

  • CVE-2015-0651Feb 27, 2015
    Cisco Systems, Inc.
    Application Networking Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID…

  • CVE-2015-2089Feb 26, 2015
    WordPress
    CrossSlide jQuery
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct…

  • CVE-2015-2083Feb 25, 2015
    Ilch
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php.

  • CVE-2015-2048Feb 23, 2015
    Dlink
    DCS-931L
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2015-2039Feb 20, 2015
    WordPress
    Acobot Live Chat & Contact Form
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS)…

  • CVE-2015-1614Feb 19, 2015
    WordPress
    Image Metadata Cruncher
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1)…

  • CVE-2015-1585Feb 19, 2015
    Fatfreecrm
    Fat Free CRM
    risk 0.00cvss —epss 0.01

    Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

  • CVE-2014-0151Feb 13, 2015
    Red Hat
    Ovirt Engine
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.

  • CVE-2014-2152Feb 12, 2015
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the INSERT page in Cisco Prime Infrastructure (PI) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868.

  • CVE-2015-1581Feb 11, 2015
    WordPress
    Mobile Domain
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2)…

  • CVE-2015-1580Feb 11, 2015
    WordPress
    Redirection Page
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the…

  • CVE-2015-1559Feb 10, 2015
    Epignosis
    Efront
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that (1) delete modules via the delete_module…