Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in XStream, such as execution of arbitrary code, denial of service, and server-side request forgery, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2021-39146 DESCRIPTION: XStream could allow a remote authenticated attacker to execute...

GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it

Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...

Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

Snipe-IT code issue vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-IT is vulnerable to a code issue that could be exploited by attackers to conduct server-side request forgery SSRF attacks...

CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...

CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...

CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...

Server-Side Request Forgery (SSRF)

snipe/snipe-it is vulnerable to server-side request forgery. An attacker can send requests on behalf of the server into the internal network via slack integration...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654...

Server side request forgery (ssrf)

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

Exploit for Server-Side Request Forgery in Microsoft

pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-268...

Security Bulletin: IBM QRadar SIEM is vulnerable to server side request forgery (SSRF) (CVE-2021-29863)

Summary IBM QRadar SIEM is vulnerable to server side request forgery SSRF Vulnerability Details CVEID: CVE-2021-29863 DESCRIPTION: IBM QRadar SIEM is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially...

Server-Side Request Forgery in ssrf-agent

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...

VMware vCenter Server 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2021-0027)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3r or 6.7 prior to 6.7 U3p. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file read vulnerability exists in the vSphere web client. An unauthenticated, remote attacker can exploit this,...

Server side request forgery (ssrf)

Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make HTTP requests to an arbitrary domain of the attacker's choi...

MGASA-2021-0521 Updated python-reportlab packages fix security vulnerability

Server-side Request Forgery SSRF...

Updated python-reportlab packages fix security vulnerability

Server-side Request Forgery SSRF...

Redash Code Issue Vulnerability (CNVD-2021-95242)

Redash is a data integration and analysis solution from the Israeli company Redash. The product supports data integration, data visualization, query editing, and data sharing.Redash 10.0.0 and earlier versions are vulnerable to a code issue that stems from the fact that the program is vulnerable ...