CVE-2022-4335

Removed by vendor...

CVE-2022-4201

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner...

CVE-2022-4201

GitLab CE/EE contains a blind SSRF (CVE-2022-4201) affecting 11.3–11.?. versions prior to 15.4.6, 15.4.x prior to 15.5.5, and 15.6.x prior to 15.6.1. The issue allows an attacker to connect to local addresses when configuring a malicious GitLab Runner. Root cause/impact are stated as blind SSRF w...

CVE-2022-4335

A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host...

CVE-2022-4201

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner...

CVE-2022-4335

A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.11.1.P1 security update

A security update for Fuse 7.11.1 is now available for Red Hat Fuse on Karaf and Red Hat Fuse on Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly...

Server side request forgery (ssrf)

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

Lexmark Printer SSRF Vulnerability (Jan 2023)

Multiple Lexmark printer devices are prone to a server-side request forgery SSRF vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2023-24495

The CVE-2023-24495 SSRF issue in Tenable.sc arises from improper validation of session and user-accessible input data, enabling a privileged, authenticated attacker to interact with external and internal services. Public sources in the connected documents confirm that Tenable.sc prior to version ...

CVE-2022-46998

CVE-2022-46998 affects taocms v3.0.2: a vulnerability in the website background enables Server-Side Request Forgery (SSRF). CVSS 3.1 base score 9.8 (NETWORK, LOW complexity, NONE user interaction, HIGH impact on Confidentiality/Integrity/Availability). Documented exploitation exists (POC) per one...

Security Bulletin: Due to the use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to a SSRF attack (CVE-2021-39152, CVE-2021-39150)

Summary XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. Vulnerability Details...

Server-Side Request Forgery (SSRF)

rsshub is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists due to unsafe route parameter sanitation, which allows an attacker to send arbitrary HTTP requests from the server to other servers...

CVE-2023-24429

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

CVE-2023-24429

CVE-2023-24429 affects Jenkins Plugin: Semantic Versioning Plugin (versions ≤ 1.14). Root cause: XML parsing of a crafted controller/agent message that allows XML external entity (XXE) processing, enabling exfiltration of secrets from the Jenkins controller or triggering server-side requests. Imp...