VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 258 of 286
  • CVE-2014-5333Aug 19, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178…

  • CVE-2014-5205Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

  • CVE-2014-5204Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

  • CVE-2014-0969Aug 17, 2014
    IBM
    Infosphere Master Data Management Server For Product Information Management
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2…

  • CVE-2014-1546Aug 14, 2014
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the…

  • CVE-2014-5199Aug 12, 2014
    Wordpress File Upload Project
    Wordpress File Upload
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of…

  • CVE-2014-3896Jul 29, 2014
    Seeds
    Acmailer
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying…

  • CVE-2014-2974Jul 28, 2014
    Silver Peak
    Vx
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

  • CVE-2014-3305Jul 26, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735.

  • CVE-2014-2369Jul 24, 2014
    Omron
    Ns15 Hmi Terminal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2014-4671Jul 9, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.23

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file…

  • CVE-2014-3920Jul 3, 2014
    Kanboard
    Kanboard
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI.

  • CVE-2014-4614Jul 2, 2014
    Piwigo
    Piwigo
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5)…

  • CVE-2014-3881Jun 28, 2014
    Intercom
    Web Kyukincho
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Intercom Web Kyukincho 3.x before 3.0.030 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2014-3882Jun 25, 2014
    WordPress
    Login rebuilder
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2014-4333Jun 19, 2014
    Boonex
    Dolphin
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in administration/profiles.php in Dolphin 7.1.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the members[] parameter, related to…

  • CVE-2014-4188Jun 17, 2014
    Hitachi
    Tuning Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to hijack the authentication of unspecified victims via unknown…

  • CVE-2014-3850Jun 11, 2014
    WordPress
    Member Approval
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to…

  • CVE-2014-0929Jun 8, 2014
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions.

  • CVE-2014-0961Jun 8, 2014
    IBM
    Security Identity Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for…