Vulnerabilities > Cross-Site Request Forgery (CSRF)
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-03-20 | CVE-2018-8811 | Cross-Site Request Forgery (CSRF) vulnerability in Alkacon Opencms 10.5.3 Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. | 8.8 |
| 2018-03-19 | CVE-2014-2675 | Cross-Site Request Forgery (CSRF) vulnerability in Wp-Html-Sitemap Project Wp-Html-Sitemap 1.2 Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php. | 6.5 |
| 2018-03-19 | CVE-2014-2550 | Cross-Site Request Forgery (CSRF) vulnerability in Disable Comments Disable Comments Project Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php. | 8.8 |
| 2018-03-19 | CVE-2014-2274 | Cross-Site Request Forgery (CSRF) vulnerability in Subscribe to Comments Reloaded Project Subscribe to Comments Reloaded 140128/140129/140204 Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php. | 8.8 |
| 2018-03-16 | CVE-2014-4613 | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php. | 6.5 |
| 2018-03-15 | CVE-2018-6224 | Cross-Site Request Forgery (CSRF) vulnerability in Trendmicro Email Encryption Gateway 5.5 A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain. | 8.8 |
| 2018-03-15 | CVE-2018-8717 | Cross-Site Request Forgery (CSRF) vulnerability in Joyplus-Cms Project Joyplus-Cms 1.6.0 joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. | 8.8 |
| 2018-03-15 | CVE-2018-7701 | Cross-Site Request Forgery (CSRF) vulnerability in Securenvoy Securmail Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a delete action in a request to secmail/getmessage.exe or (2) spoof arbitrary users and reply to their messages via a request to secserver/securectrl.exe. | 6.5 |
| 2018-03-14 | CVE-2018-7677 | Cross-Site Request Forgery (CSRF) vulnerability in Netiq Access Manager 4.4 A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. | 8.8 |
| 2018-03-13 | CVE-2018-1000093 | Cross-Site Request Forgery (CSRF) vulnerability in Cryptonote 0.8.9 CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. | 8.8 |