Browse CVEs

HIGH 8.8 CVE-2019-13477 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the r… Webpanel No fix yet Fix from $1,9502019-08-21 HIGH 8.8 CVE-2017-18521 The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. Democracy Poll 5.4+ Fix from $1,9502019-08-21 HIGH 8.8 CVE-2016-10902 The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. Wp Customer Reviews 3.0.9+ Fix from $1,9502019-08-21 HIGH 8.8 CVE-2016-10903 The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. Godaddy Email Marketing 1.1.3+ Fix from $1,9502019-08-21 MEDIUM 6.5 CVE-2019-4167 IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitte… Storediq after 7.6.0.18 Fix from $1,6002019-08-20 HIGH 8.8 CVE-2019-4117 IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act… Cloud Private after 2.1.0.3 Fix from $1,9502019-08-20 HIGH 8.8 CVE-2017-18523 The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. Eelv Newsletter 4.6.1+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2017-18569 The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. My Wp Translate 1.0.4+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2019-15238 The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. Cformsii 15.0.2+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2011-5328 The user-access-manager plugin before 1.2 for WordPress has CSRF. User Access Manager 1.2+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2014-10381 The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. User Domain Whitelist 1.5+ Fix from $1,9502019-08-20 MEDIUM 6.5 CVE-2015-9332 The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. Wordpress Uninstall 1.2+ Fix from $1,6002019-08-20 HIGH 8.8 CVE-2016-10914 The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. Add From Server 3.3.2+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2016-10915 The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. Popup 1.7.9+ Fix from $1,9502019-08-20 HIGH 8.8 CVE-2019-15229 FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator i… Fuel Cms after 1.4.4 Fix from $1,9502019-08-20 HIGH 8.8 CVE-2019-15150 In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callb… Mw Oauth2client 0.4+ Fix from $1,9502019-08-19 HIGH 8.8 CVE-2019-15113 The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. Companion Sitemap Generator 3.7.0+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2019-15114 The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. Formcraft 1.2.2+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2019-15115 The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. Loginwp 2.9.2+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2017-18547 The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. Nelio Ab Testing 4.6.4+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2018-20971 The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. Church Admin 1.2550+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2018-20972 The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. Companion Auto Update 3.2.1+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2018-20974 The js-jobs plugin before 1.0.7 for WordPress has CSRF. Js Job Manager 1.0.7+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2015-9322 The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. Erident Custom Login And Dashboard 3.5+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2017-18544 The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. Invite Anyone 1.3.16+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2017-18546 The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. Jayj Quicktag 1.3.2+ Fix from $1,9502019-08-16 HIGH 8.8 CVE-2019-13516 In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that ha… Pi Web Api after 2018 Fix from $1,9502019-08-15 HIGH 8.8 CVE-2018-14668 In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cr… Clickhouse 1.1.54388+ Fix from $1,9502019-08-15 HIGH 8.0 CVE-2019-15062 An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files se… Dolibarr Erp\/crm Patch available Fix from $1,9502019-08-14 HIGH 8.8 CVE-2019-14216 An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-cus… Wp Svg Icons after 3.2.1 Fix from $1,9502019-08-14