Ghost CMS Server-Side Request Forgery Vulnerability

Ghost CMS is an open source headless content management system CMS written in JavaScript. A server-side request forgery vulnerability exists in Ghost CMS versions prior to 3.10.0, which can be exploited by an attacker to scan local or external networks or interact with internal systems...

uppy npm package server-side request forgery vulnerability

uppy npm package is a file upload package. A server-side request forgery vulnerability exists in versions of uppy npm package prior to 1.9.3, which can be exploited by an attacker to scan local or external networks or interact with internal systems...

CloudBees Jenkins Cobertura plugin code issue vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . Cobertura Plugin is used in one of the...

ZOHO ManageEngine Desktop Central XML External Entity Injection Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An XML external entit...

OX App Suite Server-Side Request Forgery Vulnerability (CNVD-2020-13202)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A server-side request forgery vulnerability exists in OX App Suite 7.10.2 and earlier versions. No detailed...

CVE-2019-18846

OX App Suite through 7.10.2 allows SSRF...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

PT-2020-19795

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite ZCS versions prior to 8.8.15 Patch 7 Description The software is susceptible to a Server-Side Request Forgery SSRF attack when the WebEx zimlet is installed and the zimlet JSP is enabled. A recent surge in the...

CVE-2019-4741

IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 172815...

Nextcloud server server-side request forgery vulnerability

Nextcloud is a client-server software suite for creating network hard disks. A server-side request forgery vulnerability exists in Nextcloud Server 16.0.1. An attacker could use this vulnerability to detect local and remote services when adding a new subscription in the Calendar application...

GHSA-V4QH-6367-4CX2 Server-Side Request Forgery (SSRF) in Apache Olingo

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can...

CloudBees Jenkins Robot Framework Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . CloudBees Jenkins Robot...

GitLab CE/EE Server-Side Request Forgery Vulnerability (CNVD-2020-03781)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A server-side request forgery vulnerability exists in...

SAS Institute SAS XML Mapper XML External Entity (XXE) Vulnerability

SAS Institute SAS XML Mapper is an XML mapper from the U.S. SAS SAS Institute. The product automatically analyzes the structure of XML files and generates basic metadata. An XML External Entity XXE vulnerability exists in SAS Institute SAS XML Mapper version 9.45. The vulnerability stems from an...

CVE-2018-20687

An XML external entity XXE vulnerability in CommandCenterWebServices/.?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

CVE-2019-16948

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network as opposed to what general web traffic would see...

WordPress Visualizer Server-Side Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Visualizer plugin is a chart management plugin used in it. A server-side request forgery vulnerability exists in WordPress Visualizer...

Magento Server-Side Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento has a server-side request forgery vulnerability. An attacker can exploit this vulnerability to manipulate the connector api endpoints to achieve remote code execution...

Thycotic Secret Server Server-Side Request Forgery Vulnerability

Thycotic Secret Server is a privileged account management solution designed for IT administrators and IT security professionals to help these individuals take charge and control of all processes related to password management throughout the organization. A server-side request forgery vulnerabilit...