10411 matches found
Server-side Request Forgery (SSRF)
github.com/gogs/gogs is vulnerable to server-side request forgery. An attacker can send malicious requests on behalf of the server into the network-internal hosts through the ParseRemoteAddr function of repo.go...
CVE-2021-43954
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability...
Server side request forgery (ssrf)
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability...
CVE-2021-43954
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability...
CVE-2021-43954
An SSRF vulnerability in Atlassian Fisheye and Crucible: DefaultRepositoryAdminService allows authenticated remote attackers with 'can add repository' to enumerate internal network and filesystem resources. Affected versions are before 4.8.9; fixed in 4.8.9. Impact includes potential exposure of ...
SSRF in repository migration
Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...
Server-Side Request Forgery (SSRF)
Description The fixes for CVE-2022-0767 & CVE-2022-0766 only address loopback/localhost IP addresses, this is an issue as other internal endpoints may be accessible to an attacker one of the most popular examples is 169.254.169.254 which is the AWS metadata address Proof of Concept The same as...
Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses
Researchers have disclosed three security vulnerabilities affecting Pascom Cloud Phone System CPS that could be combined to achieve a full pre-authenticated remote code execution of affected systems. Kerbit security researcher Daniel Eshetu said the shortcomings, when chained together, can lead t...
Server-Side Request Forgery (SSRF)
rudloff/alltube is vulnerable to server-side request forgery. The vulnerability exists in the 'index.php' file allowing an attacker to exploit the vulnerability by crafting a special HTML page to bypass the authentication mechanism...
CVE-2022-24739
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is onl...
Server side request forgery (ssrf)
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is onl...
CVE-2022-24739 Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is onl...
CVE-2022-24739 Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is onl...
CVE-2022-0767
Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.17...
CVE-2022-0766
Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.17...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.17...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.17...
CVE-2021-43954: File and network resource enumeration via SSRF in DefaultRepositoryAdminService
Affected versions of Atlassian Fisheye and Crucible allow remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability in the DefaultRepositoryAdminService class. When runni...
