Server-Side Request Forgery (SSRF)

appwrite/server-ce is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists via the /v1/avatars/favicon endpint which allows attackers to access network resources and sensitive information via a crafted GET request...

X2CRM 6.6 / 6.9 Cross Site Scripting

Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting XSS Authenticated Exploit Author: Betul Denizler Vendor Homepage: https://x2crm.com/ Software Link: https://sourceforge.net/projects/x2engine/ Version: X2CRM v6.6/6.9 Tested on: Ubuntu Mate 20.04 Vulnerable Parameter: Actionssubject CVE:...

Appwrite Server-Side Request Forgery vulnerability

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

GHSA-HXGX-584X-VWM8 Appwrite Server-Side Request Forgery vulnerability

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

Server side request forgery (ssrf)

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

Server-Side Request Forgery (SSRF)

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

Shoplazza 1.1 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Shoplazza 1.1 - Stored Cross-Site Scripting XSS Exploit Author: Andrey Stoykov Software Link: https://github.com/Shoplazza/LifeStyle Version: 1.1 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as normal user account 2. Browse "Blog Posts" - "Manage...

CVE-2023-27055

Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request...

Design/Logic Flaw

Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request...

CVE-2023-27055

Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request...

CVE-2023-27055

Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request...

AVer Information PTZApp 路径遍历漏洞

AVer Information PTZApp is an innovative freeware with an upgrade interface from AVer Information China. It is used to control AVer USB cameras. A security vulnerability exists in AVer Information PTZApp version v20.01044.48. An attacker has exploited the vulnerability to access sensitive files v...

The vulnerability of the administration interface of FortiOS operating systems and the FortiProxy proxy server, which allows attackers to gain unauthorized access to protected information.

The vulnerability of the administrative interface of FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

Fortinet Fortigate Access of NULL pointer in SSLVPNd (FG-IR-22-477)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-477 advisory. - An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through...

Design/Logic Flaw

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

Fortinet FortiRecorder 资源管理错误漏洞

Fortinet FortiRecorder is the U.S. fly tower Fortinet company's set of Web-based network video recorder management system. A resource management error vulnerability exists in Fortinet FortiRecorder, which arises from improper management of system resources e.g., memory, disk space, files, etc. by...