CWE-352 Cross-Site Request Forgery (CSRF)
compoundThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (10343)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-62593US | high8.8OT kritisch | KEV | ||
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox an… | ||||
| CVE-2023-2533US | high8.8OT kritisch | KEV | ||
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF, which, under specific conditions, could potentially enable
an attacker to alter security se… | ||||
| CVE-2020-10181US | critical9.8OT kritisch | KEV | ||
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by… | ||||
| CVE-2016-6277US | high8.8OT kritisch | KEV | ||
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.… | ||||
| CVE-2016-3718US | medium5.5OT kritisch | KEV | ||
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted ima… | ||||
| CVE-2014-100005US | high8.0OT kritisch | KEV | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of ad… | ||||
| CVE-2008-4128US | high9.3OT kritisch | KEV | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to ex… | ||||
| CVE-2022-41622US | high8.8 | Exploit | ||
In all versions,
BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.
Note: Software versions which have reached End of Technic… | ||||
| CVE-2019-16667US | high8.8 | Exploit | ||
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces… | ||||
| CVE-2025-54782US | high8.8 | Exploit | ||
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the… | ||||
| CVE-2018-7700US | high8.8 | — | ||
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP… | ||||
| CVE-2015-6973US | medium6.8 | Exploit | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests tha… | ||||
| CVE-2015-2295US | medium6.8 | Exploit | ||
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication… | ||||
| CVE-2014-0054US | medium6.8 | — | ||
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote atta… | ||||
| CVE-2013-6429US | medium6.8 | — | ||
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attack… | ||||
| CVE-2019-9787US | high8.8 | Exploit | ||
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF prot… | ||||
| CVE-2022-27226US | high8.8 | Exploit | ||
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequen… | ||||
| CVE-2019-0235US | high8.8 | Exploit | ||
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. | ||||
| CVE-2017-1000479US | high8.8 | Exploit | ||
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occu… | ||||
| CVE-2013-3568US | high8.8 | Exploit | ||
Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via… | ||||
03
Angriffsmuster (4)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan