SSRF via Plugin SMTP

Description The SMTP plugin doesn't have verification or validation, allowing the attacker to make requests to internal servers and get the contents. Reproduce 1. Go to Team & Settings 2. App Store SMTP 3. Configure and intercept Test request 4. Change Host/Port to internal address, example:...

U.S. Dept Of Defense: Unauthorized Access to Internal Server Panel without Authentication

The server can be accessed without any authentication and it contains information that should not be kept public for anyone. I advice you to take look if this data are sensitive or not! References ███████ Impact There might be sensitive info that should not have to be leaked to public. System Hos...

Exploit for CVE-2022-26646

Tittle: Online Banking System LFI. Author: Erik451 C...

GHSA-Q24H-5RQ3-63J9 Incorrect Authorization in @uppy/companion

@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers files to the destination server, and finally download them If each of these files had a guessable and regular na...

PT-2021-22481 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue allows an attacker to access internal server-to-server RPC endpoints, enabling them to download raw data from Datanode and Ozone manager, and modify Ratis replication configuration...

TIBCO Partnerexpress 安全漏洞

TIBCO Partnerexpress is a Php-based platform that generates barcodes by product name from TIBCO USA. A security vulnerability exists in the internal server and gateway server components of TIBCO PartnerExpress, versions 6.2.1 and below, which can be exploited by an attacker to perform a...

CVE-2021-25972: Server-Side Request Forgery (SSRF)

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery SSRF in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read...

Eyoucms Server Side Request Forgery (CVE-2021-39497)

A sever-side request forgery vulnerability exists in Eyoucms. The vulnerability is due to a lack of validation on the subdomain parameter in HTTP requests. Successful exploitation of this vulnerability could allow an unauthenticated attacker to make a request to any internal and external server...

Unable to add Store in Native Workspace/Receiver App from External Machines

On adding Store error "Your account cannot be added" or "Could not detect the specific account" appears On Storefront no errors in event viewer Wireshark trace on NetScaler shows, NetScaler senta request to Storefront server for "/Agservices/Discover", storefront server returns "500 : Internal...

CVE-2021-33705

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery SSRF vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request e.g. POST, G...

CVE-2021-28910

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-28910

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-28910: Server-Side Request Forgery (SSRF)

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-22255

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

Design/Logic Flaw

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

CVE-2021-22255

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

CVE-2021-33213

The CVE-2021-33213 entry documents an SSRF in Elements-IT HTTP Commander 5.3.3, specifically in the Upload from URL feature. When authenticated, an attacker can supply an internal address to retrieve HTTP/FTP resources from the internal network, exposing internal resources. Root cause: SSRF in th...

CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

CVE-2021-33213: Server-Side Request Forgery (SSRF)

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...