slipstream

NAT Slipstreaming NAT 滑流攻击 允许攻击者远程访问受害者 NAT 后方 任意系统 上的任何 TCP/UDP 服务，只需受害者访问一个网站即可绕过受害者的 NAT/防火墙（远程任意防火墙端口控制）。 v1 开发者 ：@SamyKamkar // https://samy.pl v2 开发者 ：Samy Kamkar && Ben Seri && Gregory Vishnipolsky of Armis。 阅读Ben 和 Gregory 关于 v2 的优秀技术文章，其中深入介绍了他们对 v2 的更新以及大量额外细节。 v1 发布日期 ：2020年10月31日 👻 v2...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 PoC de SSRF de LobeChat ★ Descripción CVE-2024-47066 : Lobe Chat es un framework de chat de inteligencia artificial de código abierto. Antes de la versión 1.19.13, la protección contra server-side request forgery implementada en src/app/api/proxy/route.ts no...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

Memos 0.13.2 - Server-Side Request Forgery

SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...

CVE-2023-27163

Proof Of Concept of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and...

hikvision-unauthenticated-rce-cve-2021-36260

Vulnerabilidad RCE CVE-2021-36260 en Hikvision Descripción de la vulnerabilidad Un atacante puede aprovechar esta vulnerabilidad para obtener un control total del dispositivo mediante una shell root sin restricciones, incluso cuando el propietario del dispositivo está limitado a una shell protegi...

Review.CVE-2023-5612

CVE-2023-5612 – GitLab SSRF via Webhook URL PoC & Analysis 📌 CVE Overview CVE-ID: CVE-2023-5612 Severity: High CVSS: 8.1 Base Score Type: Server-Side Request Forgery SSRF Component: GitLab CE/EE Webhooks Affected Versions: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888" ...

basketcraft

basketcraft este es un script que explota la vulnerabilidad CVE-2023-27163, que es un SSRF en request-baskets versión 1.2.1 SSRF en Request-Baskets CVE-2023–27163 CVE-2023–27163 representa una vulnerabilidad crítica de falsificación de solicitudes del lado del servidor Server-Side Request Forgery...

Linux Distros Unpatched Vulnerability : CVE-2026-76177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...

CVE-2026-76177

Ocsreports for OCS Inventory NG contains a Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint. The root cause is insufficient validation of the HTTPS_SERV and FILE_SERV parameters, allowing an authenticated user with operator privileges to supply ...

CVE-2026-33752

CVE-2026-33752 CVE-2026-33752 SSRF basado en redirecciones que permite el acceso a la red interna en curlcffi Resumen curlcffi no restringe las solicitudes a rangos de IP internos y sigue las redirecciones automáticamente mediante la librería subyacente libcurl. Debido a esto, una URL controlada...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...

CVE-2021-36260

Vulnerabilidad RCE CVE-2021-36260 en Hikvision Descripción de la vulnerabilidad Un atacante puede aprovechar esta vulnerabilidad para obtener un shell root sin restricciones y tomar el control total del dispositivo, incluso si el propietario del dispositivo está limitado a un shell protegido...

CVE-2026-82477

In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts...

CVE-2026-82477

MITRE SAF Heimdall versions 2.11.6 through 2.13.x are affected by a Server-Side Request Forgery (SSRF) vulnerability in the Tenable proxy endpoint , specifically in apps/backend/src/tenable/tenable.controller.ts. A remote, unauthenticated attacker can leverage this flaw to access internal network...

CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-53509

@aborruso/ckan-mcp-server (an MCP server for querying CKAN open data portals) is vulnerable to SSRF prior to version 0.4.106 . The validateServerUrl hostname check in src/utils/http.ts only blocked the literal string localhost, but hostname aliases such as ip6-localhost and ip6-loopback (defined ...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...