CVE-2012-3343

Cross-site request forgery CSRF vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences, a different...

CVE-2014-3455

Multiple cross-site request forgery CSRF vulnerabilities in the 1 CreateProperty, 2 CreateTemplate, 3 CreateForm, and 4 CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the...

CVE-2014-3454

Cross-site request forgery CSRF vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vecto...

CVE-2012-4494

The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in...

CVE-2013-3963

Cross-site request forgery CSRF vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WPHD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified...

CVE-2013-3451

Multiple cross-site request forgery CSRF vulnerabilities in Cisco Unified Communications Manager Unified CM allow remote attackers to hijack the authentication of arbitrary users for requests that perform arbitrary Unified CM operations, aka Bug ID CSCui13033...

CVE-2013-3392

Multiple cross-site request forgery CSRF vulnerabilities in Cisco WebEx Social allow remote attackers to hijack the authentication of arbitrary users via unspecified vectors, aka Bug IDs CSCuh10405 and CSCuh10355...

CVE-2013-0320

Cross-site request forgery CSRF vulnerability in the Taxonomy Manager taxonomymanager module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors...

CVE-2013-3250

Cross-site request forgery CSRF vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings...

CVE-2013-2697

Cross-site request forgery CSRF vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-9300

Cross-site request forgery CSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentication of users for requests that access unauthorized URLs and obtain user...

CVE-2013-2305

Cross-site request forgery CSRF vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2005-2916

Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has been processed, which allows remote attackers to 1 modify configuration using restore.cgi or 2 upload new firmware using upgrade.cgi...

CVE-2009-2738

Cross-site request forgery CSRF vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors...

CVE-2008-7241

Cross-site request forgery CSRF vulnerability in PunBB before 1.2.17 allows remote attackers to hijack the authentication of unspecified users for requests related to a logout, probably a forced logout...

DRUPAL-CONTRIB-2025-068

The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Trail: User Authentication is enabled, it logs user authentication events login, logout, and password reset requests. The module does not sufficiently limit some large values befo...

Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Trail: User Authentication is enabled, it logs user authentication events login, logout, and password reset requests. The module does not sufficiently limit some large values befo...

CVE-2025-48015

Failed login response could be different depending on whether the username was local or central...

CVE-2025-48015 Observable Response Discrepancy

Failed login response could be different depending on whether the username was local or central...

CVE-2025-47938

TYPO3 vulnerability CVE-2025-47938 affects multiple TYPO3 releases: 9.0.0 up to but not including 9.5.51 ELTS, 10.x up to 10.4.50 ELTS, 11.x up to 11.5.44 ELTS, 12.x up to 12.4.31 LTS, and 13.x up to 13.4.12 LTS. The backend user management interface allows password changes without requiring the ...