Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8849 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2013-7464 1 Csrf-magic Project 1 Csrf-magic 2024-11-21 N/A
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
CVE-2013-6365 3 Debian, Horde, Opensuse 3 Debian Linux, Groupware, Opensuse 2024-11-21 5.3 Medium
Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
CVE-2013-6364 2 Debian, Horde 2 Debian Linux, Groupware 2024-11-21 8.8 High
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
CVE-2013-6275 2 Debian, Horde 2 Debian Linux, Groupware 2024-11-21 6.5 Medium
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
CVE-2013-4665 1 Spbas 1 Business Automation Software 2024-11-21 6.5 Medium
SPBAS Business Automation Software 2012 has CSRF.
CVE-2013-3935 1 Opsview 2 Opsview, Opsview Core 2024-11-21 8.8 High
Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.
CVE-2013-3568 1 Cisco 2 Linksys Wrt110, Linksys Wrt110 Firmware 2024-11-21 8.8 High
Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
CVE-2013-3516 1 Netgear 4 Wnr3500l, Wnr3500l Firmware, Wnr3500u and 1 more 2024-11-21 6.5 Medium
NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens.
CVE-2013-3366 1 Trendnet 2 Tew-812dru, Tew-812dru Firmware 2024-11-21 8.8 High
Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3.
CVE-2013-3312 1 Loftek 2 Nexus 543, Nexus 543 Firmware 2024-11-21 8.8 High
Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration, as demonstrated by a request to set_users.cgi.
CVE-2013-3093 1 Asus 14 Dsl-n55u, Dsl-n55u Firmware, Rt-ac66u and 11 more 2024-11-21 8.8 High
ASUS RT-N56U devices allow CSRF.
CVE-2013-2109 1 Undolog 1 Wp Cleanfix 2024-11-21 8.8 High
WordPress plugin wp-cleanfix has Remote Code Execution
CVE-2013-2108 1 Undolog 1 Cleanfix 2024-11-21 5.4 Medium
WordPress WP Cleanfix Plugin 2.4.4 has CSRF
CVE-2013-10027 1 Wordpress 1 Blogger Importer 2024-11-21 4.3 Medium
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
CVE-2013-10025 1 Exit Strategy Project 1 Exit Strategy 2024-11-21 4.3 Medium
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
CVE-2013-0196 1 Redhat 2 Enterprise Linux, Openshift 2024-11-21 6.5 Medium
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
CVE-2013-0185 1 Redhat 2 Cloudforms Managementengine, Manageiq Enterprise Virtualization Manager 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
CVE-2012-4385 2 Debian, Trilexnet 2 Debian Linux, Letodms 2024-11-21 6.5 Medium
letodms 3.3.6 has CSRF via change password
CVE-2012-10015 1 Bestwebsoft 1 Twitter 2024-11-21 4.3 Medium
A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
CVE-2012-10012 1 Bestwebsoft 1 Facebook Button 2024-11-21 4.3 Medium
A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The patch is named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225355.