IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 198241.

CVE-2021-20621HIGHCVSS 8.8EG 8.8

2021-01-28

Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vecto…

CVE-2021-20636MEDIUMCVSS 6.5EG 6.5

2021-02-12

Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes …

CVE-2021-20641MEDIUMCVSS 6.5EG 6.5

2021-02-12

Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of…

CVE-2021-20646MEDIUMCVSS 6.5EG 6.5

2021-02-12

Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be…

CVE-2021-20647MEDIUMCVSS 6.5EG 6.5

2021-02-12

Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be…

CVE-2021-20650MEDIUMCVSS 6.5EG 6.5

2021-02-12

Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may …

CVE-2021-20652HIGHCVSS 8.8EG 8.8

2021-02-05

Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2021-20687HIGHCVSS 8.8EG 8.8

2021-04-07

Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2021-20758HIGHCVSS 8.0EG 8.0

2021-08-18

Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication of administrators and perform an arbitrary operation via unspecified vectors.

CVE-2021-20779HIGHCVSS 8.8EG 8.8

2021-07-07

Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2021-20780HIGHCVSS 8.8EG 8.8

2021-07-07

Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2021-20781HIGHCVSS 8.8EG 8.8

2021-07-14

Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecifie…

CVE-2021-20782HIGHCVSS 8.8EG 8.8

2021-07-14

Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2021-20783HIGHCVSS 8.8EG 8.8

2021-07-30

Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page.

CVE-2021-20786MEDIUMCVSS 4.3EG 4.3

2021-07-30

Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3…

CVE-2021-20795HIGHCVSS 8.8EG 8.8

2021-10-13

Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to hijack the authentication of administrators and unintended operations may be performed via unspeci…

CVE-2021-20831HIGHCVSS 8.8EG 8.8

2021-10-13

Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors.

CVE-2021-20842MEDIUMCVSS 6.5EG 6.5

2021-11-24

Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.

CVE-2021-20845HIGHCVSS 8.8EG 8.8

2021-11-24

Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web pag…

CVE-2021-20846HIGHCVSS 8.8EG 8.8

2021-11-24

Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially…

CVE-2021-20851HIGHCVSS 8.8EG 8.8

2021-12-01

Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.

CVE-2021-20860HIGHCVSS 8.8EG 8.8

2021-12-01

Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533G…

CVE-2021-21027MEDIUMCVSS 4.3EG 4.3

2021-02-11

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of …

CVE-2021-21241HIGHCVSS 7.4EG 7.4

2021-01-11

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too fr…

CVE-2021-21275MEDIUMCVSS 5.3EG 5.3

2021-01-25

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has …

CVE-2021-21395MEDIUMCVSS 4.2EG 4.2

2023-01-27

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF bet…

CVE-2021-21407HIGHCVSS 8.0EG 8.0

2021-07-21

Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3…

CVE-2021-21495HIGHCVSS 8.8EG 8.8

2021-01-04

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.

CVE-2021-21549HIGHCVSS 8.8EG 8.8

2021-05-21

Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked in…

CVE-2021-21617HIGHCVSS 8.8EG 8.8

2021-02-24

A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurations.

CVE-2021-21620MEDIUMCVSS 4.3EG 4.3

2021-02-24

A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.

CVE-2021-21627HIGHCVSS 8.8EG 8.8

2021-03-18

A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains.

CVE-2021-21629HIGHCVSS 8.8EG 8.8

2021-03-30

A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters.

CVE-2021-21633HIGHCVSS 8.8EG 8.8

2021-03-30

A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.

CVE-2021-21638HIGHCVSS 8.8EG 8.8

2021-03-30

A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another metho…

CVE-2021-21641MEDIUMCVSS 4.3EG 4.3

2021-04-07

A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.

CVE-2021-21644MEDIUMCVSS 5.4EG 5.4

2021-04-21

A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

CVE-2021-21652HIGHCVSS 7.1EG 7.1

2021-05-11

A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anothe…

CVE-2021-21655HIGHCVSS 7.1EG 7.1

2021-05-11

A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.

CVE-2021-21665HIGHCVSS 8.8EG 8.8

2021-06-10

A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, c…

CVE-2021-21675MEDIUMCVSS 6.5EG 6.5

2021-06-30

A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests.

CVE-2021-21678HIGHCVSS 8.8EG 8.8

2021-08-31

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

CVE-2021-21679HIGHCVSS 8.8EG 8.8

2021-08-31

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

CVE-2021-21729MEDIUMCVSS 6.5EG 6.5

2021-04-13

Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H10…

CVE-2021-21731HIGHCVSS 8.1EG 8.1

2021-04-13

A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request …

CVE-2021-21745MEDIUMCVSS 4.3EG 4.3

2021-10-20

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.

CVE-2021-22202LOWCVSS 2.4EG 2.4

2021-04-02

An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

CVE-2021-22224HIGHCVSS 7.1EG 7.1

2021-07-07

A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim

CVE-2021-22500MEDIUMCVSS 6.5EG 6.5

2021-02-06

Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could be exploited by attacker to trick the users into executing actions of the a…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 54 of 173

Map vulnerabilities like CWE-352 to your infrastructure