CWE-352— Cross-Site Request Forgery (CSRF)

CVE-2022-36886MEDIUMCVSS 4.3EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specifi…

CVE-2022-36887MEDIUMCVSS 4.3EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.

CVE-2022-36906MEDIUMCVSS 6.5EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions…

CVE-2022-36908MEDIUMCVSS 6.5EG 5.4

A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.

CVE-2022-36911MEDIUMCVSS 6.5EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a S…

CVE-2022-36916HIGHCVSS 8.0EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2022-36920HIGHCVSS 8.8EG 7.1

A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.

CVE-2022-36968MEDIUMCVSS 4.3EG 4.3

A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cr…

2022-08-02

In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks.

CVE-2022-37043MEDIUMCVSS 5.7EG 5.7

2022-08-12

An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page…

CVE-2022-37405MEDIUMCVSS 4.3EG 8.8

CVE-2022-37411MEDIUMCVSS 5.4EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.

CVE-2022-3747HIGHCVSS 8.8EG 6.5

Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress.

2022-11-29

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated …

CVE-2022-3750MEDIUMCVSS 4.7EG 4.7

2022-11-21

The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.

CVE-2022-3763HIGHCVSS 8.1EG 8.1

2022-11-21

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded…

CVE-2022-37719HIGHCVSS 8.8EG 8.8

2023-01-23

A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors.

CVE-2022-37730HIGHCVSS 8.8EG 8.8

2022-09-07

In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick him to click on a malicious link or visit a page containing attack code, and send a request to the…

CVE-2022-3776HIGHCVSS 8.8EG 8.8

2022-11-03

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several fu…

CVE-2022-38059MEDIUMCVSS 5.5EG 8.0

CVE-2022-38062MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.

2023-07-17

Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.

CVE-2022-38063MEDIUMCVSS 5.4EG 8.8

2023-03-16

Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.

CVE-2022-38075MEDIUMCVSS 6.1EG 6.1

2022-11-18

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.

CVE-2022-38077MEDIUMCVSS 4.3EG 8.8

2023-03-29

Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.

CVE-2022-38079MEDIUMCVSS 5.4EG 8.8

CVE-2022-38085MEDIUMCVSS 5.4EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.

CVE-2022-38086MEDIUMCVSS 5.4EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.

2022-10-11

Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.

CVE-2022-38093MEDIUMCVSS 5.4EG 8.8

CVE-2022-38095MEDIUMCVSS 5.4EG 4.3

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.

CVE-2022-38137MEDIUMCVSS 4.3EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.

2022-11-08

Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.

CVE-2022-38139MEDIUMCVSS 5.4EG 8.8

2022-09-13

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.

CVE-2022-38144HIGHCVSS 8.8EG 8.8

CVE-2022-38329MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.

2022-09-13

A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to perform unintended actions on an affected system. The vulnerability could allow …

CVE-2022-38356MEDIUMCVSS 5.4EG 5.4

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.

CVE-2022-38359HIGHCVSS 8.8EG 8.8

2022-08-15

Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the UR…

CVE-2022-38454MEDIUMCVSS 5.4EG 8.8

CVE-2022-38468MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress.

2023-03-01

Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.

CVE-2022-3847MEDIUMCVSS 6.1EG 6.1

2022-11-28

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS pa…

CVE-2022-38470MEDIUMCVSS 4.3EG 8.8

CVE-2022-3850MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

2022-11-28

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack

CVE-2022-3852HIGHCVSS 8.8EG 6.5

2022-11-03

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated…

CVE-2022-3853MEDIUMCVSS 5.4EG 5.4

CVE-2022-38660HIGHCVSS 8.3EG 8.8

Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.

2022-11-04

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.

CVE-2022-38704MEDIUMCVSS 5.4EG 4.3

CVE-2022-38716MEDIUMCVSS 5.4EG 5.4

Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.

CVE-2022-3879MEDIUMCVSS 6.5EG 6.5

CVE-2022-3880MEDIUMCVSS 6.5EG 6.5

The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and acti…

CVE-2022-3881MEDIUMCVSS 5.7EG 5.7

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber…

CVE-2022-3882MEDIUMCVSS 6.5EG 6.5

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticate…