9843 matches found
CVE-2025-48739
TheHive SSRF (CVE-2025-48739) affects TheHive server versions 5.2.0–5.2.15, 5.3.0–5.3.10, 5.4.0–5.4.9, and 5.5.0, where remote authenticated admins can manipulate URLs in API endpoints to proxy requests to internal or restricted hosts/ports. Root cause: SSRF allowing proxying through TheHive to a...
SonicWall SMA 1000 Series < 12.4.3-02963 SSRF (SNWLID-2025-0010)
The remote host is a SonicWall SMA 1000 Series device that may be affected by a server-side request forgery SSRF vulnerability. An SSRF vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthenticated attacker could potentially cau...
CVE-2022-24129
The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...
CVE-2022-23668
A remote authenticated server-side request forgery ssrf vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manage that address this security vulnerability...
CVE-2022-43140
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...
CVE-2022-43183
XXL-Job before v2.3.1 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...
CVE-2022-42183
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery SSRF...
CVE-2022-41495
ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery SSRF via the rssurlnews parameter at /manager/index.php...
CVE-2022-38298
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery SSRF via redirecting incoming requests to the AWS internal metadata endpoint...
CVE-2022-3338
An External XML entity XXE vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file throu...
CVE-2022-32995
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery SSRF via the template remote download function...
CVE-2022-34013
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery SSRF vulnerability via the Logo parameter under the Link module...
CVE-2022-41412
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery SSRF attacks...
CVE-2022-30049
A Server-Side Request Forgery SSRF in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl parameter...
CVE-2022-29631
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequestset and jodd.http.HttpRequestsend. These vulnerabilities allow attackers to execute Server-Side Request Forgery SSRF via a crafted TCP payload...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-28616
A remote server-side request forgery ssrf vulnerability was discovered in HPE OneView versions: Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView...
CVE-2022-27426
A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...
CVE-2022-27234
Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...