Cross-Site Request Forgery

Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.

1. NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows…CVE-2018-12364Mozilla · 1.8% likely

   CWE-352

2. Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created i…CVE-2012-4205Mozilla · 1.6% likely

   CWE-352

3. Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the…CVE-2013-6167Mozilla · 1.5% likely

   CWE-352

4. Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hi…CVE-2011-0046Mozilla · 1.1% likely

   CWE-352

5. Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remot…CVE-2020-15660Mozilla · 1.1% likely

   CWE-352

6. In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Rea…CVE-2018-12370Mozilla · 1.1% likely

   CWE-352

7. POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Requ…CVE-2019-11712Mozilla · 1.0% likely

   CWE-352

8. The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects aft…CVE-2015-0807Mozilla · 1.0% likely

   CWE-352

9. The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin head…CVE-2014-8638Mozilla · 1.0% likely

   CWE-352

10. Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authen…CVE-2011-0059Mozilla · 1.0% likely

    CWE-352

11. Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary use…CVE-2011-3669Mozilla · 0.9% likely

    CWE-352

12. Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users…CVE-2011-3668Mozilla · 0.9% likely

    CWE-352

13. Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack th…CVE-2012-0453Mozilla · 0.8% likely

    CWE-352

14. Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote…CVE-2013-4227Mozilla · 0.8% likely

    CWE-352

15. A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mo…CVE-2017-5394Mozilla · 0.8% likely

    CWE-352

16. Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authen…CVE-2009-1213Mozilla · 0.7% likely

    CWE-352

17. Incorrect handling of SameSite cookiesCVE-2024-6611Mozilla · CVSS 9.8 · 0.7% likely

    CWE-1275

18. A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Fir…CVE-2023-4047Mozilla · 0.6% likely

    CWE-352

19. Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows rem…CVE-2012-0440Mozilla · 0.6% likely

    CWE-352

20. Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords…CVE-2009-0483Mozilla · 0.6% likely

    CWE-352

21. Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 all…CVE-2013-1734Mozilla · 0.6% likely

    CWE-352

22. Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for reque…CVE-2013-1733Mozilla · 0.6% likely

    CWE-352

23. Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficien…CVE-2009-0486Mozilla · 0.6% likely

    CWE-352

24. Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag…CVE-2009-0485Mozilla · 0.5% likely

    CWE-352

25. Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via…CVE-2009-0484Mozilla · 0.5% likely

    CWE-352

26. The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x be…CVE-2014-1546Mozilla · 0.5% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.