CVE-2021-21288: Server-Side Request Forgery (SSRF)

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...

Arbitrary File Read Vulnerability in Lanproxy

Lanproxy is an intranet penetration tool that proxies LAN PCs and servers to the public network, supports tcp traffic forwarding, and can support any tcp upper-layer protocols access to intranet sites, debugging of local payment interfaces, ssh access, remote desktop, etc.. Lanproxy has an...

Arbitrary File Read Vulnerability in Lanproxy Intranet Penetration Tool

Lanproxy is an intranet penetration tool that proxies LAN PCs and servers to the public network, supports tcp traffic forwarding, and can support any tcp upper-layer protocols access to intranet sites, debugging of local payment interfaces, ssh access, remote desktop, etc.. Lanproxy Intranet...

January 12, 2021—KB4598279 (Monthly Rollup)

None None...

January 12, 2021—KB4598229 (OS Build 18363.1316) - EXPIRED

None None...

January 12, 2021—KB4598243 (OS Build 14393.4169) - EXPIRED

None None...

Directory Traversal Vulnerability in LanProxy Intranet Penetration Tool

Lanproxy is an intranet penetration tool that proxies services on the LAN to the public network. A path traversal vulnerability exists in lanproxy, which can be exploited by an attacker to obtain sensitive information...

CVE-2021-3019

ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet...

Directory traversal

ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet...

CVE-2021-3019

ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet...

CVE-2021-3019

ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet...

Ffay Lanproxy Path Traversal Vulnerability

Ffay Lanproxy is an intranet penetration tool that proxies services on the LAN to the public network by Ffay's personal developer. A path traversal vulnerability exists in ffay lanproxy 0.1, which allows directory traversal to read /... /conf/config.properties to obtain credentials for an intrane...

Zammad Information Disclosure Vulnerability (CNVD-2020-75060)

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability stems from the way Massenversand's implementation of the SMS configuration interface presents the results of test requests to the...

CVE-2020-26032

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may le...

Server side request forgery (ssrf)

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may le...

CVE-2020-26032

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may le...

Zammad 代码问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability stems from the way Massenversand's implementation of the SMS configuration interface presents the results of test requests to the...

CVE-2020-35710

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

CVE-2020-35710

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

CVE-2020-35710

Parallels Remote Application Server (RAS) 18 is affected. The issue allows remote attackers to discover an intranet IP address because, after submitting the login form (even with blank credentials), the attacker's client receives the host IP via a second request to RASHTML5Gateway/socket.io conta...