CVE-2022-41609

The CVE concerns the WordPress Better Messages plugin, version 1.9.10.68 or earlier, which is vulnerable to an authenticated Server-Side Request Forgery (SSRF) when access is allowed to subscribers. The root cause involves the plugin validating parameters before making external/internal requests,...

GHSA-M5XF-X7Q6-3RM7 KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

PT-2022-25983 · Unknown · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin version 1.9.10.68 Description: The issue is related to an Authenticated Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially forge requests to internal or external services, but...

XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

XXL-Job before v2.4.0 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

EUVD-2022-7276

XXL-JOB vulnerable to Server-Side Request Forgery SSRF...

GHSA-83W4-X5W9-HF4H XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

XXL-Job before v2.4.0 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

CVE-2022-42894

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. An unauthenticated Server-Side Request Forgery SSRF vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as loca...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

Server side request forgery (ssrf)

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

Server-Side Request Forgery (SSRF)

github.com/kubevela/kubevela is vulnerable to server-side request forgery. The vulnerability is due to common.go because the request address in the warehouse is not properly restricted which allows an attacker to cause a SSRF bypass via a crafted url...

CVE-2022-43183

XXL-JOB prior to v2.3.1 is affected by a Server-Side Request Forgery (SSRF) in the component /admin/controller/JobLogController.java . The issue stems from the code path handling JobLog operations, enabling SSRF according to multiple connected sources. The public CVE entry CVE-2022-43183 consolid...

CVE-2022-43140

kkFileView 4.1.0 is vulnerable to a Server-Side Request Forgery (SSRF) in cn.keking.web.controller.OnlinePreviewController#getCorsFile. By injecting crafted URLs into the url parameter, an attacker can force the application to make arbitrary outbound requests, potentially exposing internal resour...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

CVE-2022-42894

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. An unauthenticated Server-Side Request Forgery SSRF vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as loca...

WordPress All in One SEO Pack Plugin < 4.2.6 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aioseo:allinoneseo"; if description...

CVE-2022-42894

Siemens syngo Dynamics is affected by an unauthenticated Server-Side Request Forgery (SSRF) in a web service exposed by the application for all versions prior to VA40G HF01. The vulnerability can leak NTLM credentials and enable local service enumeration. Public documentation across multiple sour...

CVE-2022-43183

XXL-Job before v2.3.1 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

CVE-2022-39383

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...