inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a …

CVE-2013-5708NONECVSS 0.0EG 0.0

2013-09-06

Coursemill Learning Management System (LMS) 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via vectors related to cookies, a different vuln…

CVE-2013-5726NONECVSS 0.0EG 0.0

2013-11-12

Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the…

CVE-2013-5730NONECVSS 0.0EG 0.0

2013-11-20

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or disable Wireless MAC Address…

CVE-2013-5748NONECVSS 0.0EG 0.0

2014-05-12

Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an add_project action.

CVE-2013-5937NONECVSS 0.0EG 0.0

2013-09-25

Cross-site request forgery (CSRF) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving th…

CVE-2013-5954NONECVSS 0.0EG 0.0

2014-04-25

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertise…

CVE-2013-5977NONECVSS 0.0EG 0.0

2013-11-01

Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify prod…

CVE-2013-5993NONECVSS 0.0EG 0.0

2013-11-21

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.

CVE-2013-6018NONECVSS 0.0EG 0.0

2013-10-28

Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password.

CVE-2013-6028NONECVSS 0.0EG 0.0

2014-01-12

Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts, (2) modify user accounts, (3) del…

CVE-2013-6166NONECVSS 0.0EG 0.0

2014-02-15

Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted par…

CVE-2013-6167NONECVSS 0.0EG 0.0

2014-02-15

Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted …

CVE-2013-6173NONECVSS 0.0EG 0.0

2013-11-21

Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Ente…

CVE-2013-6188NONECVSS 0.0EG 0.0

2014-03-14

Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 7.1 through 7.2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2013-6192NONECVSS 0.0EG 0.0

2013-12-17

Cross-site request forgery (CSRF) vulnerability in HP Operations Orchestration before 9 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2013-6202NONECVSS 0.0EG 0.0

2014-02-24

Multiple cross-site request forgery (CSRF) vulnerabilities in HP Service Manager 9.30, 9.31, 9.32, and 9.33 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) insert XSS sequences or (2) execut…

CVE-2013-6275MEDIUMCVSS 6.5EG 6.5

2019-11-05

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

CVE-2013-6346NONECVSS 0.0EG 0.0

2013-11-02

Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2013-6357NONECVSS 0.0EG 0.0

2013-11-13

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via t…

CVE-2013-6364HIGHCVSS 8.8EG 8.8

2019-11-05

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

CVE-2013-6365MEDIUMCVSS 5.3EG 5.3

2019-11-05

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

CVE-2013-6443NONECVSS 0.0EG 0.0

2014-01-23

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

CVE-2013-6710NONECVSS 0.0EG 0.0

2013-12-14

Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Training Center allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCul25567.

CVE-2013-6797NONECVSS 0.0EG 0.0

2013-11-19

Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed…

CVE-2013-6811HIGHCVSS 8.8EG 8.8

2019-11-22

Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote …

CVE-2013-6826NONECVSS 0.0EG 0.0

2013-11-20

cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.

CVE-2013-6852NONECVSS 0.0EG 0.0

2013-11-22

Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method.

CVE-2013-6883NONECVSS 0.0EG 0.0

2013-12-17

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique set…

CVE-2013-6922NONECVSS 0.0EG 0.0

2014-01-21

Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accoun…

CVE-2013-6942NONECVSS 0.0EG 0.0

2014-03-11

Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to hijack the authentication of unsp…

CVE-2013-6976NONECVSS 0.0EG 0.0

2013-12-19

Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter …

CVE-2013-6992NONECVSS 0.0EG 0.0

2014-01-03

Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that…

CVE-2013-7043NONECVSS 0.0EG 0.0

2013-12-10

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a p…

CVE-2013-7053HIGHCVSS 8.8EG 8.8

2020-02-04

D-Link DIR-100 4.03B07: cli.cgi CSRF

CVE-2013-7057NONECVSS 0.0EG 0.0

2014-11-04

Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1…

CVE-2013-7107NONECVSS 0.0EG 0.0

2014-01-15

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypas…

CVE-2013-7204NONECVSS 0.0EG 0.0

2014-01-17

Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users.

CVE-2013-7209NONECVSS 0.0EG 0.0

2013-12-30

Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary use…

CVE-2013-7233NONECVSS 0.0EG 0.0

2013-12-30

Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move com…

CVE-2013-7251NONECVSS 0.0EG 0.0

2014-01-02

Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fib…

CVE-2013-7256NONECVSS 0.0EG 0.0

2014-01-03

Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2013-7320NONECVSS 0.0EG 0.0

2014-02-06

Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via …

CVE-2013-7334NONECVSS 0.0EG 0.0

2014-03-11

Cross-site request forgery (CSRF) vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter, related to CVE-2012-6290.

CVE-2013-7346NONECVSS 0.0EG 0.0

2014-03-27

Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, …

CVE-2013-7352NONECVSS 0.0EG 0.0

2014-04-02

Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] p…

CVE-2013-7376NONECVSS 0.0EG 0.0

2014-05-14

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal…

CVE-2013-7407NONECVSS 0.0EG 0.0

2014-10-22

Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2013-7464HIGHCVSS 8.8EG 8.8

2018-08-08

In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.

CVE-2013-7473HIGHCVSS 8.8EG 8.8

2019-08-01

Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 15 of 173

Map vulnerabilities like CWE-352 to your infrastructure