CVE-2025-53473

Server-side request forgery SSRF vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers...

CVE-2022-28090

Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery SSRF via /cmscp/ext/collect/fetchurl.do?url=...

php: Configuring a proxy in a stream context might allow for CRLF injection in URIs

A flaw was found in PHP. In affected versions of PHP, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the...

CVE-2025-47484

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through = 1.1.0...

CVE-2024-10207 Server-Side Request Forgery (authenticated) in APROL Web Portal

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs...

CVE-2024-5186

A Server-Side Request Forgery SSRF vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically,...

Apache Ambari 代码问题漏洞

Apache Ambari is a software application from the Apache USA Foundation. Provides software developed to configure, manage and monitor Apache Hadoop clusters to simplify Hadoop management. A code issue vulnerability exists in Apache Ambari versions prior to 2.7.9, which stems from a vulnerability...

The vulnerability of the Windows Telephony Service in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows Telephony Service in Windows operating systems is related to reading data beyond the allowed range in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending requests to the server...

Schneider Electric Modicon M580 安全漏洞

The Schneider Electric Modicon M580 is a programmable automation controller from Schneider Electric France. A security vulnerability exists in the Schneider Electric Modicon M580 that stems from the inclusion of a buffer size miscalculation vulnerability that could result in a denial of service o...

Open Redirect

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Open Redirect via the Uri parsing functionality. An attacker can redirect users to malicious websites or potentially initiate server-side request forgery attacks...

Microsoft Purview 代码问题漏洞

Microsoft Purview is a service provided by Microsoft for data governance and compliance. A security vulnerability exists in Microsoft Purview, which can be exploited by an attacker to trigger a server to send a request to an internal or external network via a well-constructed request, which could...

UBUNTU-CVE-2024-50285

In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbdworkcache”. It will cause OOM issue. ksmbd has a credit mechanism but it can'...

DataEase 代码问题漏洞

DataEase is a lightweight, high-performance self-service data visualization and analysis tool that helps users quickly explore and understand complex data, provides real-time data analysis and report generation capabilities, supports a variety of data sources, and is designed to improve data...

Conduit Security Vulnerabilities

Conduit is a simple, fast and reliable chat server from the individual developer Timo Kösters. A security vulnerability exists in Conduit versions prior to v0.8.0, which stems from a key expiration that is not taken into account when verifying signatures, which could lead to an attacker using the...

WordPress plugin Google Doc Embedder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2024:1307-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1307-1 advisory. Update to 18.20.1 Security fixes: - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::Http2Session that could le...

Design/Logic Flaw

A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests...

CVE-2023-33299

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed...

CVE-2023-27745

An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server...

PT-2023-21315 · South River Technologies · Titan Sftp

Name of the Vulnerable Software and Affected Versions: South River Technologies TitanFTP versions prior to 2.0.1.2102 Description: The issue allows attackers with low-level privileges to perform administrative actions by sending requests to the user server. Recommendations: For versions prior to...