Total
7646 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-20414 | 1 Cisco | 2 Ios, Ios Xe | 2024-10-02 | 6.5 Medium |
| A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device. | ||||
| CVE-2024-8476 | 1 Wpplugin | 1 Easy Paypal Events | 2024-10-02 | 4.3 Medium |
| The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-47305 | 1 Dineshkarki | 1 Use Any Font | 2024-10-02 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font allows Cross Site Request Forgery.This issue affects Use Any Font: from n/a through 6.3.08. | ||||
| CVE-2024-47082 | 1 Strawberryrocks | 1 Strawberry | 2024-10-01 | 4.6 Medium |
| Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanism for their servers. Additionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default. In affect, all Strawberry integrations were vulnerable to CSRF attacks by default. Version `v0.243.0` is the first `strawberry-graphql` including a patch. | ||||
| CVE-2024-47315 | 1 Givewp | 1 Givewp | 2024-09-30 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in GiveWP.This issue affects GiveWP: from n/a through 3.15.1. | ||||
| CVE-2024-7862 | 2 Blogintroduction Wordpress Plugin, Kimhuebel | 2 Blogintroduction Wordpress Plugin, Blogintroduction-wordpress-plugin | 2024-09-30 | 4.3 Medium |
| The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-3083 | 1 Proges | 2 Sensor Net Connect Firmware V2, Sensor Net Connect V2 | 2024-09-30 | 8.3 High |
| A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page. | ||||
| CVE-2024-8044 | 2 Rubayathasan, Wordpress Plugin | 2 Infolinks Ad Wrap, Infolinks Ad Wrap | 2024-09-30 | 5.7 Medium |
| The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-7863 | 1 Pixeljar | 1 Favicon Generator | 2024-09-27 | 8.1 High |
| The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server | ||||
| CVE-2024-7864 | 1 Pixeljar | 1 Favicon Generator | 2024-09-27 | 6.5 Medium |
| The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server | ||||
| CVE-2024-8047 | 2 Gowildchild, Visual Sound | 2 Visual Sound, Visual Sound | 2024-09-27 | 5.7 Medium |
| The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-8490 | 1 Wp-property-hive | 1 Propertyhive | 2024-09-27 | 8.8 High |
| The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-7817 | 2 Michalaugustyniak, Misiek Photo Album | 2 Misiek Photo Album, Misiek Photo Album | 2024-09-27 | 6.5 Medium |
| The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack | ||||
| CVE-2024-8043 | 2 Seanschulte, Wordpress Plugin | 2 Vikinghammer Tweet, Vikinghammer Tweet | 2024-09-27 | 5.7 Medium |
| The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | ||||
| CVE-2024-8051 | 2 Moc, Wordpress Plugin | 2 Special Feed Items, Special Feed Items | 2024-09-27 | 5.7 Medium |
| The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | ||||
| CVE-2024-8091 | 2 Jakesnyder, Jupitercow | 2 Enhanced Search Box, Enhanced Search Box | 2024-09-27 | 4.8 Medium |
| The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-8092 | 2 Alaingg, Alaingonzalez | 2 Accordion Image Menu, Accordion Image Menu | 2024-09-27 | 5.4 Medium |
| The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | ||||
| CVE-2024-8093 | 2 Lucas Garcia, Lucasgarcia | 2 Posts Reminder, Posts Reminder | 2024-09-27 | 4.8 Medium |
| The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-7820 | 2 Elliot, Ilc Thickbox | 2 Ilc Thickbox, Ilc Thickbox | 2024-09-27 | 4.3 Medium |
| The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-7859 | 2 Visual Sound, Visual Sound Project | 2 Visual Sound, Visual Sound | 2024-09-27 | 6.5 Medium |
| The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||