CVE-2022-34269

CVE-2022-34269 affects RWS WorldServer versions prior to 11.7.3. An authenticated, remote attacker can trigger a blind SSRF via the endpoint ws-legacy/load_dtd?system_id=, causing JSP code deployment to the Apache Axis service on localhost and resulting in command execution. Documented impact is ...

PT-2023-13354 · Apache · Apache Axis

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions prior to 11.7.3 Description: An issue was discovered that allows an authenticated, remote attacker to perform a blind SSRF attack using the ws-legacy/load dtd?system id= endpoint to deploy JSP code to the Apache Axis...

CVE-2023-51451 SSRF in symbolicator via invalid protocol

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

CVE-2023-50259

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50258

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

Server side request forgery (ssrf)

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50259 Blind SSRF in /home/testslack endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50259

CVE-2023-50259 affects Medusa prior to 1.0.19, where the /home/testslack endpoint allows unauthenticated blind SSRF. The issue arises because the testslack handler does not validate the user-controlled slack_webhook URL, passing it to notifiers.slack_notifier.test_notify, then _notify_slack and _...

CVE-2023-50259 Blind SSRF in /home/testslack endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

CVE-2023-50258

Summary (CVE-2023-50258): Medusa is an open-source video library manager. Versions prior to 1.0.19 are vulnerable to an unauthenticated blind server-side request forgery (SSRF) in the testDiscord handler. The issue stems from not validating the user-controlled discord_webhook variable and passing...

CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

Authenticated Blind SSRF in automad/automad

automad up to 1.10.9 is vulnerable to an authenticated blind server-side request forgery in importUrl as the import function on the FileController.php file was not properly validating the value of the importUrl argument. This issue may allow attackers to perform a port scan against the local...

GHSA-6QM2-WPXQ-7QH2 Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

Older versions of gradio contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL e.g. if the demo was created with share=True, or on Hugging Face Spaces...

Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

Older versions of gradio contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL e.g. if the demo was created with share=True, or on Hugging Face Spaces...

CVE-2023-7037 automad FileController.php import server-side request forgery

A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can be initiated remotely. The exploit ha...

Server Side Request Forgery (SSRF)

mlflow is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused by following redirects while fetching HTTP artifact contents within the model-versions/get-artifact endpoint. A malicious user can exploit this to access internal HTTPs servers and in the worst case achieve remo...

JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF

Description The plugin does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks. wpfgc url="http://127.0.0.1:8084"...

JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF

Description The plugin does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks. PoC wpfgc url="http://127.0.0.1:8084"...

MLflow Server-Side Request Forgery (SSRF)

A malicious user could use this issue to access internal HTTPs servers and in the worst case ie: aws instance it could be abused to get a remote code execution on the victim machine...