CVE-2018-8939

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

Cockpit Server-Side Request Forgery Vulnerability

Cockpit is an open source CMS Content Management System for managing structured content. A server-side request forgery vulnerability exists in Cockpit version 0.13.0. A remote attacker can exploit this vulnerability to read arbitrary files or send TCP traffic to an internal network host with the...

CVE-2018-8801

GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component...

UBUNTU-CVE-2018-8801

GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component...

CVE-2018-10220

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation...

PT-2018-9762 · Honeynet · Glastopf

Name of the Vulnerable Software and Affected Versions: Glastopf version 3.1.3-dev Description: The issue concerns a Server-Side Request Forgery SSRF in Glastopf, demonstrated through the abc.php a parameter. It is noted that the vendor considers this behavior intentional, as Glastopf is a web...

Onethink Ueditor Server-Side Request Forgery Vulnerability

Onethink is a content management framework for web development based on ThinkPHP.Ueditor is one of the HTML editors. A server-side request forgery vulnerability exists in the getRemoteImage.php file of Ueditor in Onethink version 1.0 and 1.1. A remote attacker can exploit this vulnerability with...

CVE-2017-16614

SSRF Server Side Request Forgery in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php fBill parameter...

CVE-2018-7516

A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could lead to proxied network scans...

PT-2018-1306 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 18.0 Description: A Server-Side Request Forgery SSRF issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to th...

I Librarian I-librarian XXE vulnerability

I Librarian I-librarian is an application for editing PDF files. An XXE vulnerability exists in line 154 of the importmetadata.php file in I Librarian I-librarian 4.8 and earlier versions. An attacker can exploit this vulnerability to read the contents of a file and perform a server-side request...

UBUNTU-CVE-2018-7667

Adminer through 4.3.1 has SSRF via the server parameter...

Adminer Server-Side Request Forgery Vulnerability

Adminer is a full-featured database management tool written in PHP that supports database software such as MySQL, MariaDB, PostgreSQL and SQLite. A server-side request forgery vulnerability exists in Adminer 4.3.1 and earlier versions. An attacker can exploit this vulnerability with the help of t...

CloudBees Jenkins Android Lint Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Android Lint Plugin is used in one of the Android static Android Lint...

CVE-2018-7055

GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter...

Sandstorm Server-Side Request Forgery Vulnerability Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A server-side request forgery vulnerability exists in the install application process in versions prior to Sandstorm build 0.203. A remote attacker can exploi...

Atlassian Bitbucket Server Server-Side Request Forgery Vulnerability

Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution is able to manage and review code with features such as diff view, JIRA integration and build integration.Github repository importer is one of the Github repository import modules. A server-side reque...

The vulnerability of the Apache XML-RPC library (ws-xmlrpc) is related to improper restrictions on XML links to external objects, which allows attackers to perform SSRF attacks.

The vulnerability of the Apache XML-RPC library ws-xmlrpc is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks using specially crafted DTDs...

CloudBees Jenkins PMD Plugin XML External Entity Injection Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . PMD Plugin is used in one of the...

CloudBees Jenkins Warnings Plugin XML External Entity Injection Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Warnings Plugin is the use of a code...