13995 matches found
CVE-2023-20174
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...
Server side request forgery (ssrf)
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...
CVE-2023-20174
Cisco ISE CVE-2023-20174 refers to multiple vulnerabilities in the web-based management interface, stemming from XML External Entity Injection. When authenticated as an administrator, an attacker could read arbitrary files or perform SSRF via the affected device. The root cause is XML handling in...
CVE-2023-20173
Cisco Identity Services Engine (ISE) is affected by CVE-2023-20173, an XML External Entity Injection vulnerability in the web-based management interface that can allow an authenticated, remote attacker with valid Administrator credentials to read arbitrary files or perform SSRF. The exploitation ...
CVE-2023-20173 Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...
Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...
CVE-2023-31848
davinci 0.3.0-rc is vulnerable to Server-side request forgery SSRF...
PT-2023-2779 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE. These vulnerabilities could allow an...
CVE-2023-30510 Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface
A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...
CVE-2023-31848
CVE-2023-31848 affects davinci 0.3.0-rc and is caused by a server-side request forgery (SSRF) vulnerability. The available sources consistently identify the affected component as the davinci application, version 0.3.0-rc, with SSRF as the underlying issue. The CVSS 3.1 base metrics in the initial...
Security Bulletin: Open Source Dependency Vulnerability
Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2022-3172 DESCRIPTION: Kubernetes kube-apiserver is vulnerable to server-side request forgery, caused by a flaw with allowing an aggregated API server to redirect client traffic to any URL. By...
Mozilla: [Hubs] - Broken access control in placing objects in hubs room
A broken access control vulnerability allowed an attacker to bypass object creation and movement restrictions in Mozilla Hubs. By using specific commands in the chat feature, the attacker could place objects in a room even if the admin user had disabled these actions. The vulnerability did not...
CVE-2022-29840
Server-Side Request Forgery SSRF vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This...
CVE-2022-29840
CVE-2022-29840 is a Server-Side Request Forgery (SSRF) in Western Digital My Cloud OS 5 devices prior to version 5.26.202. The issue lets a rogue server on the local network modify its URL to point to the loopback adapter, with potential to exploit other vulnerabilities on the local server. The o...
Security Bulletin: Apache CXF is vulnerable to CVE-2022-46364 used in IBM Maximo Application Suite - Monitor Component
Summary IBM Maximo Application Suite - Monitor Component uses Apache CXF which is vulnerable to CVE-2022-46364. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM...
imgproxy is vulnerable to Server-Side Request Forgery
imgproxy prior to version 3.15.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter...
GHSA-9X7H-GGC3-XG47 imgproxy is vulnerable to Server-Side Request Forgery
imgproxy prior to version 3.15.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter...