VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 252 of 286
  • CVE-2015-1432Feb 10, 2015
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

  • CVE-2015-1568Feb 9, 2015
    Drupal
    GD Infinite Scroll
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified…

  • CVE-2014-9041Feb 4, 2015
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks.

  • CVE-2015-0596Feb 2, 2015
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163.

  • CVE-2014-7270Feb 1, 2015
    Asus
    Rt N56u Firmware
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware…

  • CVE-2015-0588Jan 15, 2015
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.

  • CVE-2014-9587Jan 15, 2015
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.

  • CVE-2014-7957Jan 15, 2015
    WordPress
    Pods
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle…

  • CVE-2014-8638Jan 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct…

  • CVE-2014-100025Jan 13, 2015
    Savsoft Technologies
    Savsoft Quiz
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php/user_data/insert_user in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request.

  • CVE-2014-10027Jan 13, 2015
    Dlink
    DAP-1360
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 router with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that (1) change the MAC filter restrict mode, (2) add a MAC address to the…

  • CVE-2014-10025Jan 13, 2015
    Dlink
    DAP-1360
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that change the (1) Enable Wireless, (2) MBSSID, (3) BSSID, (4) Hide Access Point,…

  • CVE-2014-10006Jan 13, 2015
    Maianscriptworld
    Uploader
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting (XSS) attacks via the width parameter to (1) uploader/admin/js/load_flv.js.php…

  • CVE-2014-100001Jan 13, 2015
    WordPress
    LiveOptim
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these…

  • CVE-2014-2838Jan 12, 2015
    WordPress
    Gd Star Rating
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats…

  • CVE-2014-9510Jan 9, 2015
    TP-Link
    TL-WR840N
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the administration console in TP-Link TL-WR840N (V1) router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a…

  • CVE-2014-8031Jan 9, 2015
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456.

  • CVE-2015-0920Jan 8, 2015
    WordPress
    Banner Effect Header
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the…

  • CVE-2014-4636Jan 7, 2015
    EMC Corporation
    Documentum Web Development Kit
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations.

  • CVE-2014-9525Jan 5, 2015
    WordPress
    Timed Popup
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct…