Fedora 38 : moodle (2023-3ca351353f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3ca351353f advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Fedora 37 : moodle (2023-ce24b63b36)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce24b63b36 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

SafeURL-Python's hostname blocklist does not block FQDNs

Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...

Server-side Request Forgery (SSRF)

moodle/moodle is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists because it does not properly define the subnet which allows an attacker to bypass SSRF validation...

Server-side Request Forgery (SSRF)

github.com/owncast/owncast is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists in the GetWebfingerLinks function at webfinger.go which allows a malicious attacker to send HTTP requests to arbitrary locations using the GET HTTP method leading to SSRF...

WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WPGraphQL Type Plugin Vulnerable versions = 1.14.5 Fixed in 1.14.6 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-23684 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID b0a8de3a4ab4 Credits Ravi Dharmawan Required privilege...

CVE-2023-3432 Server-Side Request Forgery (SSRF) in plantuml/plantuml

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

CVE-2023-3432

CVE-2023-3432 (PlantUML) is a Server-Side Request Forgery vulnerability in plantuml/plantuml tracked across multiple feeds. Affected: PlantUML prior to 1.2023.9. Root cause: SSRF in the server handling diagram rendering, enabling potentially crafted requests to be manipulated by an attacker. Impa...

CVE-2023-3432 Server-Side Request Forgery (SSRF) in plantuml/plantuml

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 Text4Shell Testing Script This repository co...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 Text4Shell Testing Script This repository co...

CVE-2023-3432

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

CVE-2023-33176

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176

BigBlueButton (BBB) SSRF vulnerability (CVE-2023-33176) enables server-side request forgery via the insertDocument URL for presentation downloads. The public descriptions describe that the URL supplied could be used without proper validation, leading to SSRF. A patch updated PresentationUrlDownlo...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Poll Maker Type Plugin Vulnerable versions = 4.6.2 Fixed in 4.6.3 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-34013 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 1e96fbd28aa6 Credits Khalid Yusuf Required...

CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...

CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...