2073 matches found
Server side request forgery (ssrf)
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF...
PT-2020-15840
Name of the Vulnerable Software and Affected Versions MicroStrategy versions 10.4, 2019 before Update 6, and 2020 before Update 2 Description A Server-Side Request Forgery SSRF issue affects the PDF generation, allowing authenticated users to access internal network resources or leak local system...
CVE-2020-27624
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF...
Server side request forgery (ssrf)
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...
CVE-2020-28168
A flaw was found in nodejs-axios. The Axios NPM package contains a Server-Side Request Forgery SSRF vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. Mitigation A mitigation exists where by catching the...
CVE-2020-28168
Axios NPM package 0.21.0 contains a Server-Side Request Forgery SSRF vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address...
CVE-2020-28168
Axios NPM package 0.21.0 contains a Server-Side Request Forgery SSRF vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address...
CVE-2020-15002
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
Server side request forgery (ssrf)
InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...
CVE-2020-15822
In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped...
CVE-2020-27197
TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the nonetwork setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library...
PYSEC-2020-59
DISPUTED TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the nonetwork setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxm...
Researchers Find Vulnerabilities in Microsoft Azure Cloud Service
As businesses are increasingly migrating to the cloud, securing the infrastructure has never been more important. Now according to the latest research, two security flaws in Microsoft's Azure App Services could have enabled a bad actor to carry out server-side request forgery SSRF attacks or...
Server-side Request Forgery (SSRF)
phantomjs-seo is vulnerable to server-side request forgery SSRF. An attacker is able to submit requests on behalf of the PhantomJS instance...
Server-Side Request Forgery (SSRF)
node-pdf-generator is vulnerable to server-side request forgery SSRF. Lack of input validation allows an attacker to submit requests on behalf of the server...
BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)
Exploit Title: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery Unauthenticated Date: 2020-09-30 Exploit Author: LiquidWorm Vendor Homepage: https://www.brightsign.biz Version: = 8.2.26 BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SS...
CVE-2020-24570
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue with resultant SSRF in the commb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link...
CVE-2020-15594
An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product...
BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF
Summary BrightSign designs media players and provides free software and cloud networking solutions for the commercial digital signage market worldwide, serving all vertical segments of the marketplace. Description Unauthenticated Server-Side Request Forgery SSRF vulnerability exists in the...