A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, captur…

CVE-2022-41263MEDIUMCVSS 4.3EG 4.3

2022-12-12

Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an authenticated non-administrator attacker to modify the data source information for a document that…

CVE-2022-41296MEDIUMCVSS 6.5EG 8.8

2022-12-12

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.

CVE-2022-41297MEDIUMCVSS 4.3EG 6.5

2022-12-01

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.

CVE-2022-4138MEDIUMCVSS 6.4EG 8.1

2023-02-13

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a pr…

CVE-2022-41413MEDIUMCVSS 4.3EG 4.3

2022-11-30

perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Search function.

CVE-2022-41474MEDIUMCVSS 6.5EG 6.5

2022-10-13

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account.

CVE-2022-41475HIGHCVSS 8.8EG 8.8

2022-10-13

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account.

CVE-2022-4148MEDIUMCVSS 4.3EG 4.3

2023-03-20

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.

CVE-2022-41489HIGHCVSS 8.1EG 8.1

2022-10-13

WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication i…

CVE-2022-41500HIGHCVSS 8.8EG 8.8

2022-10-18

EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components.

CVE-2022-41608MEDIUMCVSS 5.4EG 5.4

2023-05-22

Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.

CVE-2022-41615MEDIUMCVSS 6.1EG 6.1

2022-11-18

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

CVE-2022-41620MEDIUMCVSS 5.4EG 8.8

2023-02-08

Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.

CVE-2022-41622HIGHCVSS 8.8EG 8.8

2022-12-07

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2022-41633MEDIUMCVSS 5.4EG 8.8

2023-04-04

Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.

CVE-2022-41634MEDIUMCVSS 5.4EG 8.8

2022-11-18

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

CVE-2022-41635MEDIUMCVSS 4.3EG 4.3

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.

CVE-2022-41685MEDIUMCVSS 5.4EG 8.8

2022-11-18

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

CVE-2022-41805MEDIUMCVSS 5.4EG 4.3

2022-11-18

Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

CVE-2022-41919MEDIUMCVSS 4.2EG 4.2

2022-11-22

Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-…

CVE-2022-41924CRITICALCVSS 9.6EG 9.6

2022-11-23

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bou…

CVE-2022-41925HIGHCVSS 8.8EG 8.8

2022-11-23

A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. …

CVE-2022-41927HIGHCVSS 7.4EG 7.4

2022-11-23

XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's poss…

CVE-2022-41987MEDIUMCVSS 6.3EG 6.3

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.

CVE-2022-41990HIGHCVSS 7.1EG 7.1

2024-01-17

Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8.

CVE-2022-41996HIGHCVSS 8.8EG 8.8

2022-10-27

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.

CVE-2022-42070HIGHCVSS 8.8EG 8.8

2022-10-14

Online Birth Certificate Management System version 1.0 is vulnerable to Cross Site Request Forgery (CSRF).

CVE-2022-42077MEDIUMCVSS 6.5EG 6.5

2022-10-12

Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

CVE-2022-42078MEDIUMCVSS 6.5EG 6.5

2022-10-12

Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

CVE-2022-42086MEDIUMCVSS 6.5EG 6.5

2022-10-12

Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode.

CVE-2022-42087MEDIUMCVSS 6.5EG 6.5

2022-10-12

Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

CVE-2022-4218MEDIUMCVSS 5.4EG 4.3

2022-12-02

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated…

CVE-2022-4219MEDIUMCVSS 5.4EG 4.3

2022-12-02

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attac…

CVE-2022-42199HIGHCVSS 8.8EG 8.8

2022-10-20

Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.

CVE-2022-4220MEDIUMCVSS 5.4EG 4.3

2022-12-02

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticat…

CVE-2022-42246HIGHCVSS 8.8EG 8.8

2022-11-17

Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.

CVE-2022-42435MEDIUMCVSS 4.3EG 8.8

2023-01-04

IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…

CVE-2022-42447CRITICALCVSS 9.6EG 8.8

2023-04-02

HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.

CVE-2022-4265HIGHCVSS 8.8EG 8.8

2023-03-06

The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any a…

CVE-2022-4266MEDIUMCVSS 6.5EG 6.5

2022-12-26

The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack

CVE-2022-42751HIGHCVSS 8.8EG 8.8

2022-11-03

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative …

CVE-2022-42880MEDIUMCVSS 6.1EG 6.1

2023-06-13

Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS).

CVE-2022-43031HIGHCVSS 8.8EG 8.8

2022-11-09

DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.

CVE-2022-4309LOWCVSS 3.1EG 3.1

2023-01-16

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.

CVE-2022-43323HIGHCVSS 8.8EG 8.8

2022-11-14

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module.

CVE-2022-43340HIGHCVSS 8.8EG 8.8

2022-10-27

A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.

CVE-2022-43407HIGHCVSS 8.8EG 8.8

2022-10-19

Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (procee…

CVE-2022-43408MEDIUMCVSS 6.5EG 6.5

2022-10-19

Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' st…

CVE-2022-43418MEDIUMCVSS 4.3EG 4.3

2022-10-19

A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cre…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 75 of 175

Map vulnerabilities like CWE-352 to your infrastructure