CVE-2022-38708

CVE-2022-38708 – IBM Cognos Analytics SSRF vulnerability in IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1. The issue allows an attacker to construct URLs from user-controlled data, enabling server-side requests to internal networks or the local file system. Impact and exploit details a...

CVE-2022-38708 IBM Cognos Analytics server-side request forgery

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack SSRF attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180...

CVE-2022-42343 Adobe Campaign Classic Server-Side Request Forgery Arbitrary file system read

Adobe Campaign version 7.3.1 and earlier and 8.3.9 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URL...

CVE-2022-42343

CVE-2022-42343 affects Adobe Campaign Classic (versions 7.3.1 and earlier; 8.3.9 and earlier) with a Server-Side Request Forgery (SSRF) flaw that allows a low-privilege authenticated attacker to cause arbitrary file-system reads by injecting arbitrary URLs. The vulnerability arises from insuffici...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

Design/Logic Flaw

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2022-47514

CVE-2022-47514 affects XML-RPC.NET prior to 2.5.0. The issue is an XML External Entity (XXE) injection leading to server-side request forgery (SSRF) by an authenticated user, demonstrated via a pingback.aspx POST. A PoC exists per references. Impact: remote SSRF with high severity per CVSS. Remed...

CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2022-42343

Adobe Campaign version 7.3.1 and earlier and 8.3.9 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URL...

Server side request forgery (ssrf)

Adobe Campaign version 7.3.1 and earlier and 8.3.9 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URL...

CVE-2022-4130

CVE-2022-4130 is a documented vulnerability in Red Hat Satellite 6, described as a blind SSRF via the Referer header in Satellite server HTTP requests. The issue can trigger an external interaction from the server to an attacker-controlled endpoint when specific resources are requested and the Re...

WordPress <= 6.4.1 SSRF Vulnerability

WordPress is prone to a server-side request forgery SSRF vulnerability SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SAP BusinessObjects Business Intelligence Platform 4.2 < 4.2 SP9 P11 / 4.3 < 4.3 SP2 P8 Multiple Vulnerabilities

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is prior to 4.2 SP9 P11, 4.3 SP2 P8 or 4.3 SP3. It is, therefore, affected by multiple vulnerabilities: - A server-side request forgery vulnerability SSRF where an attacker with normal BI user...

CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

DEBIAN-CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

Race condition

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590

Summary of CVE-2022-3590 (WordPress) : WordPress versions affected by an unauthenticated blind SSRF in the pingback feature due to a TOCTOU race between validation and the HTTP request, enabling access to internal hosts explicitly forbidden. Documented impact includes unauthenticated blind SSRF p...