CVE-2015-4619

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/06/16/20Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/75216Third Party Advisory, VDB Entry
https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75Issue Tracking, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/16/20Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/75216Third Party Advisory, VDB Entry
https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-46207.8name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DN CVE-2015-46247.5Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.CVE-2015-46254.6Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privilege CVE-2015-46267.5B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a nega CVE-2015-46279.8SQL injection vulnerability in Pragyan CMS 3.0.CVE-2015-46286.5SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authen CVE-2015-46299.8Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication,CVE-2015-46308.0Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and CVE-2015-46315.4Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x CVE-2015-46327.5Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before CVE-2015-46339.8Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 CVE-2015-46347.5SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_gra