Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8626 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-7440 1 Jio 2 Jiofi 4g M2s, Jiofi 4g M2s Firmware 2024-11-21 N/A
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
CVE-2019-7433 1 Rental Bike Script Project 1 Rental Bike Script 2024-11-21 N/A
PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
CVE-2019-7402 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via CSRF.
CVE-2019-7391 1 Zyxel 4 Dsl-491hnu-b10b, Dsl-491hnu-b10b Firmware, Dsl-491hnu-b1b V2 and 1 more 2024-11-21 N/A
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
CVE-2019-7357 1 Intelliants 1 Subrion Cms 2024-11-21 8.8 High
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
CVE-2019-7346 1 Zoneminder 1 Zoneminder 2024-11-21 N/A
A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.
CVE-2019-7281 1 Primasystems 1 Flexair 2024-11-21 8.8 High
Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
CVE-2019-7273 1 Optergy 2 Enterprise, Proton 2024-11-21 8.8 High
Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-7270 1 Nortekcontrol 4 Linear Emerge 5000p, Linear Emerge 5000p Firmware, Linear Emerge 50p and 1 more 2024-11-21 8.8 High
Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-7262 1 Nortekcontrol 4 Linear Emerge Elite, Linear Emerge Elite Firmware, Linear Emerge Essential and 1 more 2024-11-21 8.8 High
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-6967 1 Airties 2 Air 5341, Air 5341 Firmware 2024-11-21 N/A
AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
CVE-2019-6779 1 Chshcms 1 Cscms 2024-11-21 N/A
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
CVE-2019-6710 1 Zyxel 2 Nbg-418n, Nbg-418n Firmware 2024-11-21 N/A
Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
CVE-2019-6636 1 F5 2 Big-ip Advanced Firewall Manager, Big-ip Application Security Manager 2024-11-21 N/A
On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can perform this attack are resource administrator and administrator.
CVE-2019-6607 1 F5 1 Big-ip Application Security Manager 2024-11-21 N/A
On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the admin user.
CVE-2019-6561 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 8.8 High
Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.
CVE-2019-6510 1 Creditease-sec 1 Insight 2024-11-21 N/A
An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF.
CVE-2019-6509 1 Creditease-sec 1 Insight 2024-11-21 N/A
An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF.
CVE-2019-6508 1 Creditease-sec 1 Insight 2024-11-21 N/A
An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF.
CVE-2019-6507 1 Creditease-sec 1 Insight 2024-11-21 N/A
An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF.