CVE-2014-3850

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

CVE-2014-3836

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that 1 conduct cross-site scripting XSS attacks, 2 modify files, or 3 rename files via unspecified vectors...

CVE-2014-2946

Cross-site request forgery CSRF vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request...

CVE-2013-3258

The CVE concerns the Digg Digg WordPress plugin (versions before 5.3.5). A Cross‑Site Request Forgery (CSRF) vulnerability could allow an attacker to hijack a user’s authenticated session and cause authenticated requests that modify plugin settings via unspecified vectors. The root cause details ...

CVE-2013-3476

The CVE concerns the WordPress Related Posts plugin (prior to version 2.6.2) for WordPress, where a Cross-Site Request Forgery (CSRF) vulnerability could allow remote attackers to hijack user authentication and perform settings changes via unspecified vectors. The underlying issue is a CSRF flaw ...

CVE-2013-2698

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...

CVE-2013-3477

Cross-site request forgery CSRF vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change settings via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2013-2713

KrisonAV CMS 3.0.1 (and likely earlier) is affected by a CSRF vulnerability in users_maint.html that allows an attacker to create a new administrator account via a crafted request. The root cause is insufficient verification of the HTTP request origin, enabling an unauthorized user to hijack admi...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

CVE-2014-3843

Cross-site request forgery CSRF vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-3845

Cross-site request forgery CSRF vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. NOTE: some of these details are obtained from third par...

CVE-2014-3792

Cross-site request forgery CSRF vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005retail allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the uiViewToolsPassword and uiViewToolsPasswordConfirm parameters to...

CVE-2014-3760

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

CVE-2013-2700

Vulnerability: CSRF in WP125 WordPress plugin (Add/Edit page adminmenus.php) affecting versions before 1.5.0. Attackers could hijack admin sessions to add/edit ads via unspecified vectors. Impact: unauthorized actions on admin-privileged functionality. Remediation: upgrade the WP125 plugin to ver...

CVE-2013-7376

OpenX 2.8.10 (possibly before revision 82710) contains CSRF vulnerabilities that can hijack administrator authentication. The issue is demonstrated via requests that perform directory traversal through the group parameter to www/admin/plugin-preferences.php or www/admin/plugin-settings.php. The c...

CVE-2014-2989

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...