9781 matches found
Full Read Server-Side Request Forgery (SSRF)
🔒️ Requirements Privileges: None. 📝 Description The avatarUrl post parameter from /api/users.update and /api/teams.update api endpoint isn't sanitize and permit to get a full read SSRF exploitation. When updating user's or team's avatar, even if from client side we can only change it by uploading...
Atlassian Jira Server and Data Center Server-side Request Forgery Vulnerability
Atlassian Jira Server & Data Center is the data center version of JIRA from Atlassian Australia. The software is widely used in work areas such as defect tracking, customer service, requirements gathering, process approval, task tracking, project tracking and agile management.Atlassian Jira Serve...
Server side request forgery (ssrf)
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0...
CVE-2022-26135
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0...
CVE-2022-26135
CVE-2022-26135 affects Atlassian Jira Server/Data Center and Jira Service Management (Mobile Plugin for Jira) with a server-side request forgery (SSRF) via the batch endpoint. A remote, authenticated user (including sign-up users) can read server-side resources. Affected Jira Server/Data Center v...
CVE-2022-26135
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0...
Authorization Bypass
Parse-url is vulnerable to Authorization Bypass. The parseUrl function is unable to detect the correct host, leading to open redirect or server side request forgery causing information disclosure...
CVE-2022-0085
Server-Side Request Forgery SSRF in GitHub repository dompdf/dompdf prior to 2.0.0...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF in GitHub repository dompdf/dompdf prior to 2.0.0...
CVE-2022-0085
CVE-2022-0085 describes a Server-Side Request Forgery (SSRF) in the GitHub repository dompdf/dompdf affecting versions before 2.0.0. The connected documents confirm the issue is an SSRF vulnerability in dompdf/dompdf and indicate the affected scope is pre-2.0.0. No exploit details, attack vectors...
Server-side Request Forgery (SSRF)
parse-url is vulnerable to server-side request forgery SSRF attacks. Improper handling of user credentials allow remote attackers to bypass hostname checks and perform SSRF attacks via the vulnerable parseUrl function...
CVE-2017-20106
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...
Server side request forgery (ssrf)
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...
CVE-2017-20106 Lithium Forum Compose Message server-side request forgery
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...
CVE-2017-20106 Lithium Forum Compose Message server-side request forgery
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument uploadurl leads to server-side request forgery. The attack needs to be approached...
CVE-2017-20106
The CVE-2017-20106 entry concerns Lithium Forum 2017 Q1. A server-side request forgery (SSRF) vulnerability arises from manipulating the upload_url argument in the Compose Message Handler component. The attack requires local access, and public exploits have been disclosed. Documented impact indic...
Server-Side Request Forgery in parse-url
Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 7.0.0...
Server side request forgery (ssrf)
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery SSRF via the template remote download function...
CVE-2022-32995
Halo CMS v1.5.3 contains a Server-Side Request Forgery (SSRF) via the template remote download function. The issue is documented across multiple sources (NVD entry CVE-2022-32995). Root cause: SSRF in the template remote download feature allows external requests to be triggered by the server. Imp...
