Filtered by CWE-352
Filtered by vendor Subscriptions
Total 8331 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-27885 1 E107 1 E107 2024-11-21 8.8 High
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
CVE-2021-27759 1 Hcltech 1 Bigfix Inventory 2024-11-21 2.3 Low
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
CVE-2021-27758 1 Hcltech 1 Bigfix Inventory 2024-11-21 4.3 Medium
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.
CVE-2021-27557 1 Easycorp 1 Zentao 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
CVE-2021-27181 1 Altn 1 Mdaemon 2024-11-21 8.8 High
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
CVE-2021-26961 1 Arubanetworks 1 Airwave 2024-11-21 8.8 High
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
CVE-2021-26960 1 Arubanetworks 1 Airwave 2024-11-21 8.8 High
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
CVE-2021-26800 1 User Management System In Php Stored Procedure Project 1 User Management System In Php Stored Procedure 2024-11-21 6.5 Medium
Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.
CVE-2021-26474 1 Vembu 2 Bdr Suite, Offsite Dr 2024-11-21 8.6 High
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
CVE-2021-26216 1 Seeddms 1 Seeddms 2024-11-21 4.3 Medium
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
CVE-2021-26215 1 Seeddms 1 Seeddms 2024-11-21 4.3 Medium
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
CVE-2021-26071 1 Atlassian 4 Data Center, Jira, Jira Data Center and 1 more 2024-11-21 3.5 Low
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.
CVE-2021-26034 1 Joomla 1 Joomla\! 2024-11-21 6.5 Medium
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
CVE-2021-26033 1 Joomla 1 Joomla\! 2024-11-21 6.5 Medium
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
CVE-2021-25924 1 Thoughtworks 1 Gocd 2024-11-21 8.8 High
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
CVE-2021-25765 1 Jetbrains 1 Youtrack 2024-11-21 8.8 High
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
CVE-2021-25327 1 Skyworthdigital 2 Rn510, Rn510 Firmware 2024-11-21 6.5 Medium
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting (XSS).
CVE-2021-25326 1 Skyworthdigital 2 Rn510, Rn510 Firmware 2024-11-21 5.4 Medium
Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_version.asp. If Wi-Fi is connected but an unauthenticated user visits a URL, the SSID password and web UI password may be disclosed.
CVE-2021-25116 1 Enqueue Anything Project 1 Enqueue Anything 2024-11-21 6.5 Medium
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
CVE-2021-25108 1 Ip2location 1 Country Blocker 2024-11-21 7.1 High
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.