CVE-2018-6563

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.

• CWE-352

• http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/542015/100/0/threaded
• https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txtExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44631/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/542015/100/0/threaded
• https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txtExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44631/Exploit, Third Party Advisory, VDB Entry

Published

Jun 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6557The MOTD update script in the base-files package in Ubuntu 1…7
• CVE-2018-6558The pam_fscrypt module in fscrypt before 0.2.4 may incorrect…
• CVE-2018-6559The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.…
• CVE-2018-6560In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0…
• CVE-2018-6561dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload …
• CVE-2018-6562totemomail Encryption Gateway before 6.0_b567 allows remote …
• CVE-2018-6569West Wind Web Server 6.x does not require authentication for…
• CVE-2018-6574Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-rele…
• CVE-2018-6575SQL Injection exists in the JEXTN Classified 1.0.0 component…
• CVE-2018-6576SQL Injection exists in Event Manager 1.0 via the event.php …
• CVE-2018-6577SQL Injection exists in the JEXTN Membership 3.1.0 component…
• CVE-2018-6578SQL Injection exists in the JE PayperVideo 3.0.0 component f…