Important: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update

An update is now available for Red Hat Ceph Storage 3.3 - Extended Life Support on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2021-29490

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery SSRF attacks via the imageUrl parameter. This issue potentially exposes both internal and...

Server-Side Request Forgery (SSRF)

An SSRF issue in Open Distro for Elasticsearch ODFE allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope...

CVE-2021-29490

CVE-2021-29490 – Jellyfin SSRF . Jellyfin 10.7.2 and older are vulnerable to unauthenticated Server-Side Request Forgery via the imageUrl parameter, potentially exposing internal and external HTTP resources visible to the Jellyfin server. The issue is patched in version 10.7.3. A workaround is to...

CVE-2021-29145

A remote server side request forgery SSRF remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager versions prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to a Server-Side Request Forgery vulnerability (CVE-2020-28168)

Summary If an App Connect flow calls a URL controlled by a malicious actor, and App Connect Enterprise is running in an environment with a proxy, the controller of the target URL can construct a response with a redirect that results in the proxy being bypassed Vulnerability Details CVEID:...

CVE-2021-31779

The yoastseo aka Yoast SEO extension before 7.2.1 for TYPO3 allows SSRF via a backend user account...

Server-Side Request Forgery (SSRF)

matrixsydent is vulnerable to server-side request forgery SSRF. An attacker is able to send HTTP GET requests on behalf of the server to internal systems due to lack of parameter validation or IP address blacklisting...

CVE-2021-27905

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

CVE-2021-27905

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

CVE-2021-27905 SSRF vulnerability with the Replication handler

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

Import XML and RSS Feeds < 2.0.3 - Authenticated Server-side Request Forgery (SSRF)

The plugin is affected by a Server-side request forgery SSRF vulnerability via the data parameter in a moovereadxml action...

Server side request forgery (ssrf)

IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502...

Server side request forgery (ssrf)

Server Side Request Forgery SSRF vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503...

CVE-2021-26072

CVE-2021-26072 affects Atlassian Confluence Server/Data Center prior to 5.8.6, where the WidgetConnector plugin permits blind SSRF allowing remote attackers to manipulate internal network resources. The issue arises from insecure server-side requests triggered by the widgetconnector, with exploit...

CVE-2021-26715

The CVE-2021-26715 issue affects MITREid Connect OpenID Connect server (up to 1.3.3). The vulnerability is a Server-Side Request Forgery (SSRF) caused by unsafe handling of the logo_uri parameter in Dynamic Client Registration. An unauthenticated attacker can force the vulnerable server to make H...

WordPress Mapplic premium plugin <= 6.1 - Stored Cross-Site Scripting (XSS) Injection via Server-Side Request Forgery (SSRF) vulnerability

Stored Cross-Site Scripting XSS Injection via Server-Side Request Forgery SSRF vulnerability discovered by Eagle Eye in WordPress Mapplic premium plugin versions = 6.1. Solution Update the WordPress Mapplic premium plugin to the latest available version at least 7.0...

Microsoft Exchange Server ProxyLogon vulnerability

Added: 03/19/2021 Background Microsoft Exchange is an e-mail server for Microsoft Windows operating systems. Problem A server-side request forgery vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary commands. Resolution Apply the patch referenced in Microsoft Advisory...

MGASA-2021-0144 Updated xmlgraphics-commons packages fix a security vulnerability

The Apache XML Graphics Commons library is vulnerable to SSRF via the XMPParser that allow an attacker to cause the underlying server to make arbitrary GET requests CVE-2020-11988...

MGASA-2021-0139 Updated batik packages fix a security vulnerability

The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests CVE-2020-11987...