Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8760 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-5969 1 Photography Cms Project 1 Photography Cms 2024-11-21 N/A
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an admin account.
CVE-2018-5921 1 Hp 387 A2w75a, A2w75a Firmware, A2w76a and 384 more 2024-11-21 N/A
A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege.
CVE-2018-5720 1 Dodocool 2 Dc38, Dc38 Firmware 2024-11-21 N/A
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead to changing an existing user's username and password, changing the Wi-Fi password, etc.
CVE-2018-5673 1 Booking Calendar Project 1 Booking Calendar 2024-11-21 N/A
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
CVE-2018-5669 1 Read And Understood Project 1 Read And Understood 2024-11-21 N/A
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.
CVE-2018-5658 1 Responsive Coming Soon Page Project 1 Responsive Coming Soon Page 2024-11-21 N/A
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.
CVE-2018-5656 1 Weblizar 1 Pinterest-feeds 2024-11-21 N/A
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
CVE-2018-5441 1 Phoenixcontact 46 Mguard Centerport, Mguard Centerport Firmware, Mguard Core Tx Vpn and 43 more 2024-11-21 N/A
An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.
CVE-2018-5368 1 Srbtranslatin Project 1 Srbtranslatin 2024-11-21 N/A
The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.
CVE-2018-5361 1 Wpglobus 1 Wpglobus 2024-11-21 N/A
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
CVE-2018-5329 1 Beims 1 Contractorweb.net 2024-11-21 N/A
ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
CVE-2018-5301 1 Magento 1 Magento 2024-11-21 N/A
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.
CVE-2018-5285 1 Wpscoop 1 Imageinject 2024-11-21 N/A
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
CVE-2018-5123 1 Mozilla 1 Bugzilla 2024-11-21 N/A
A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.
CVE-2018-5073 1 Advanced Real Estate Script Project 1 Advanced Real Estate Script 2024-11-21 N/A
Online Ticket Booking has CSRF via admin/movieedit.php.
CVE-2018-4066 1 Sierrawireless 2 Airlink Es450, Airlink Es450 Firmware 2024-11-21 N/A
An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly, resulting in unauthenticated requests being requested through an authenticated user. An attacker can get an authenticated user to request authenticated pages on the attacker's behalf to trigger this vulnerability.
CVE-2018-3744 1 Html-pages Project 1 Html-pages 2024-11-21 9.8 Critical
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
CVE-2018-2474 1 Sap 1 Fiori 2024-11-21 N/A
SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.
CVE-2018-2442 1 Sap 2 Businessobjects Business Intelligence, Internet Graphics Server 2024-11-21 N/A
In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid.
CVE-2018-2001 1 Ibm 1 Curam Social Program Management 2024-11-21 N/A
IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.