SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Bamboo Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 8.2.1, 9.0.0, 9.1.0, 9.2.1, 9.3.0, 9.4.0 and 9.5.0 of Bamboo Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.1.26 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.1.26 Fixed in 3.2.12 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-6964 Patch priority Low CVSS severity Low 8.5 Developer KadenceWP PSID d0c9a0e1963b Credits Lucio Sá Require...

SAP NetWeaver SSRF (April 2024)

SAP NetWeaver is affected by a server-side request forgery SSRF vulnerability. Due to insufficient input validation, SAP NetWeaver application tcesiespgrmgwshealthcheckear allows an unauthenticated attacker to send crafted requests from a vulnerable web application targeting internal systems behi...

VMware Spring Framework < 5.3.34, 6.0.x < 6.0.19, 6.1.x < 6.1.6 SSRF Vulnerability - Windows

The VMware Spring Framework is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VMware Spring Framework < 5.3.34, 6.0.x < 6.0.19, 6.1.x < 6.1.6 SSRF Vulnerability - Linux

The VMware Spring Framework is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-31461

Plane, an open-source project management tool, has a Server-Side Request Forgery SSRF vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. T...

CVE-2024-31461 Plane Server-Side Request Forgery (SSRF) Vulnerability

Plane, an open-source project management tool, has a Server-Side Request Forgery SSRF vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. T...

CVE-2024-31461

Plane SSRF (CVE-2024-31461) affects versions prior to 0.17-dev. The vulnerability allows the server hosting the Plane application to make arbitrary server-side requests, potentially enabling access to internal services and leakage or manipulation of internal APIs. A patch exists in version 0.17-d...

CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets also known as to-dos. This stored XSS vulnerability can be exploited to perform...

CVE-2024-3448

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port...

CVE-2024-3448 Improper Access Control Leads to Server-Side Request Forgery in Mautic

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port...

CVE-2024-3448

CVE-2024-3448 affects Mautic, where users with low privileges can exploit improper access to ajax?action=plugin:focus:checkIframeAvailability to trigger a server-side request forgery. The flaw allows an attacker to analyze backend error messages and perform a back-end port scan. Public details in...

CVE-2023-40148

Server-side request forgery SSRF in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests...

CVE-2023-40148 PingFederate Server Side Request Forgery vulnerability

Server-side request forgery SSRF in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests...

CVE-2023-40148 PingFederate Server Side Request Forgery vulnerability

Server-side request forgery SSRF in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests...

CVE-2023-40148

CVE-2023-40148 is a PingFederate SSRF vulnerability. The issue: an unauthenticated attacker can make forged HTTP POST requests to trigger server-side requests, potentially reaching internal network resources and consuming server-side resources. Documents identify PingFederate as affected; root ca...

CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets also known as to-dos. This stored XSS vulnerability can be exploited to perform...

CVE-2024-27477

Leantime 3.0.6 is affected by a stored XSS in the ticket/title field that can be exploited to trigger SSRF. The issue affects the ticket creation/modification workflow and is documented across multiple sources (NVD/Red Hat/OSV) indicating a Cross‑Site Scripting vulnerability that could enable SSR...

Kadence Blocks < 3.2.12 - Contributor+ Server-Side Request Forgery

Description The plugin is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadenceimportgetnewconnectiondata' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary...

CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets also known as to-dos. This stored XSS vulnerability can be exploited to perform...