Security Bulletin: Multiple vulnerabilities affect the IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit

Summary The IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit are vulnerable, as per the CVEs listed in the Vulnerability Details section. These vulnerabilities affect some development tasks in the product toolkit. CVE-2022-29599 and CVE-2020-10683 only affect Test and Java...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2022-46364)

Summary IBM WebSphere Application Server Liberty is shipped with IBM Tivoli Netcool Impact as part of its server infrastructure. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Vulnerability Details...

Fedora 38 : moodle (2023-3ca351353f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3ca351353f advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Fedora 37 : moodle (2023-ce24b63b36)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce24b63b36 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

SafeURL-Python's hostname blocklist does not block FQDNs

Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...

Server-side Request Forgery (SSRF)

moodle/moodle is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists because it does not properly define the subnet which allows an attacker to bypass SSRF validation...

Server-side Request Forgery (SSRF)

github.com/owncast/owncast is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists in the GetWebfingerLinks function at webfinger.go which allows a malicious attacker to send HTTP requests to arbitrary locations using the GET HTTP method leading to SSRF...

WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WPGraphQL Type Plugin Vulnerable versions = 1.14.5 Fixed in 1.14.6 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-23684 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID b0a8de3a4ab4 Credits Ravi Dharmawan Required privilege...

CVE-2023-3432 Server-Side Request Forgery (SSRF) in plantuml/plantuml

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

CVE-2023-3432

CVE-2023-3432 (PlantUML) is a Server-Side Request Forgery vulnerability in plantuml/plantuml tracked across multiple feeds. Affected: PlantUML prior to 1.2023.9. Root cause: SSRF in the server handling diagram rendering, enabling potentially crafted requests to be manipulated by an attacker. Impa...

CVE-2023-3432 Server-Side Request Forgery (SSRF) in plantuml/plantuml

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 Text4Shell Testing Script This repository co...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 Text4Shell Testing Script This repository co...

CVE-2023-3432

Server-Side Request Forgery SSRF in GitHub repository plantuml/plantuml prior to 1.2023.9...

CVE-2023-33176

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176

BigBlueButton (BBB) SSRF vulnerability (CVE-2023-33176) enables server-side request forgery via the insertDocument URL for presentation downloads. The public descriptions describe that the URL supplied could be used without proper validation, leading to SSRF. A patch updated PresentationUrlDownlo...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Poll Maker Type Plugin Vulnerable versions = 4.6.2 Fixed in 4.6.3 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-34013 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 1e96fbd28aa6 Credits Khalid Yusuf Required...