Linux Distros Unpatched Vulnerability : CVE-2022-36112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licens...

CVE-2025-58829

Server-Side Request Forgery SSRF vulnerability in aitool Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One: from n/a through = 2.3.3...

Linux Distros Unpatched Vulnerability : CVE-2021-39935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all version...

Sangfor Behavior Management System 安全漏洞

Sangfor Behavior Management System is a behavior management software from China-based Sangfor. A security vulnerability exists in the Sangfor Behavior Management System that stems from an improperly configured XML parser, which could lead to internal file disclosure or server-side request forgery...

Dell Wyse Management Suite WMS 跨站请求伪造漏洞

Wyse Management Suite WMS is a cloud and local management platform from Dell, Inc. It is used to centrally manage Wyse lightweight endpoint devices and supports remote configuration, firmware updates, security policy management and other features. A cross-site request forgery vulnerability exists...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2025-0539

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself...

CVE-2025-0539

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself...

PT-2025-15911 · Octopus Deploy · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows an attacker to coerce the server into sending server-side requests that contain authentication material, potentially compromising the account running Octopus Server...

CVE-2024-13923

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validatefile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket creation endpoint. In createServiceFactory, external entities referenced in the CreateBucketConfiguration XML document are resolved and retrieved. This allows attackers to perform...

CVE-2023-43052

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2024-6155

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

The vulnerability of the SAP NetWeaver Administrator software-related to insufficient validation of requests on the server side allows a attacker to execute an SSRF attack.

The vulnerability of the SAP NetWeaver Administrator software relates to insufficient testing of server-side requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of software platforms for developing and managing Adobe Commerce and Magento Open Source online stores lies in insufficient validation of requests on the server side. This allows attackers to execute SSRF attacks.

The vulnerability of software platforms for developing and managing Adobe Commerce and Magento Open Source online stores is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

GHSA-3P8V-W8MR-M3X8 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

Summary The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local file. However, if a file:/ URL is directly given where a relative path resource name is...

PT-2024-31544

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 Description The issue allows an attacker to construct an XLSX file that links images from arbitrary paths. When embedding...

Bitdefender GravityZone 安全漏洞

Bitdefender GravityZone is a scanning software from Bitdefender Romania. A security vulnerability exists in Bitdefender GravityZone versions prior to 6.38.1-5, which stems from the presence of a detailed error handling issue that allows an attacker to spoof server-side requests...

WordPress plugin CoBlocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in the insufficient validation of requests on the server side, allowing an attacker to disclose protected information.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to insufficient testing of server-side requests. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...