GiveWP < 2.25.2 - Admin+ Server-Side Request Forgery

The plugin does not validate a parameter before making a request to it, which could allow users with a role of Administrator to perform an SSRF attack...

AJ-Report Server-Side Request Forgery Vulnerability

AJ-Report is a completely open source BI platform. AJ-Report version 0.9.8.6 suffers from a server-side request forgery vulnerability that can be exploited by an attacker to perform a server-side request forgery attack...

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Server side request forgery (ssrf)

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk...

Directus vulnerable to Server-Side Request Forgery On File Import

Summary Directus versions =9.22.4 is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack a...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

Server side request forgery (ssrf)

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...

CVE-2023-26492

Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to /files/import), exploitable via DNS rebinding to bypass IP deny lists and access sensitive internal data. Affected versions include Directus prior to 9.23.0 (e.g.,

U.S. Dept Of Defense: Unauthenticated Blind SSRF at https://█████ via xmlrpc.php file

An unauthenticated blind SSRF vulnerability was discovered on the xmlrpc.php file at a certain endpoint, allowing an attacker to send requests to external URLs and potentially conduct further attacks. Input validation and filtering are recommended to prevent such attacks in the future...

WordPress Styles Plugin <= 1.2.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Styles Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 0386a96da2ff Credits Dave Jong Patchstack Required privilege...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2023-20062 Cisco Unified Intelligence Center Vulnerabilities

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery SSRF attack on an affected system. Cisco plans to release software updates that address these vulnerabilities...

WordPress AMO for WP – Membership Management Plugin <= 4.6.6 is vulnerable to Server Side Request Forgery (SSRF)

Software AMO for WP – Membership Management Type Plugin Vulnerable versions = 4.6.6 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 9e6059b126e6 Credits Dave Jong...

WordPress CSS Adder By Agence-Press Plugin <= 1.5.0 is vulnerable to Server Side Request Forgery (SSRF)

Software CSS Adder By Agence-Press Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 1e10380ab266 Credits Dave Jong Patchstack...

WordPress Custom Login Admin Front-end CSS Plugin <= 1.4.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Custom Login Admin Front-end CSS Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.5 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 19400bb94bda Credits Dave Jong...

CVE-2022-46973

CVE-2022-46973 is an SSRF vulnerability affecting Report v0.9.8.6 in AJ-Report (open source BI platform). The linked documents confirm the issue is a Server-Side Request Forgery in version 0.9.8.6, with no explicit root-cause, affected components, exploit details, or remediation steps provided in...

WordPress WordPress Page Builder – Qards Plugin <= 1.0.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Page Builder – Qards Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 10ad2232337b Credits Dave Jong...