CVE-2021-3742 Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

A Server-Side Request Forgery SSRF vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigg...

CVE-2021-3742

Chatwoot/chatwoot before 2.5.0 is affected by a Server-Side Request Forgery (SSRF) via SVG file uploads used as avatars; opening the SVG can trigger SSRF and host redirection. Root cause: SVG handling allows SSRF payloads in uploaded avatars. Impact: host redirection. Remediation: upgrade to 2.5....

CVE-2021-3742 Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

A Server-Side Request Forgery SSRF vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigg...

CVE-2024-5917

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

SUSE CVE-2024-11168

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition lies in insufficient validation of requests on the server side, allowing attackers to execute SSRF attacks.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks using the user-defined URL address...

CVE-2024-49521

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could...

Security Bulletin: Due to use of Axios, IBM Event Processing is vulnerable to server-side request forgery

Summary Axios is used by IBM Event Processing frontend. CVE-2024-39338 Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relative URLs. By sending a specially...

PT-2024-8727 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 3.2.5 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send...

CVE-2024-51785

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-51785 WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-10814

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10814

Technical details about CVE-2024-10814 are not provided in the supplied documents. Monitor official advisories for updates on affected products, impact, and fixes.

PT-2024-34911 · Unknown · I Thirteen Web Solution Responsive Filterable Portfolio

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Responsive Filterable Portfolio versions 1.0.0 through 1.0.22 Description: The issue is a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to perform Server Side Request Forgery. This can...

WordPress Code Embed plugin <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Max Boll b0lli in WordPress Plugin Code Embed versions = 2.5...

CVE-2024-50811

The CVE-2024-50811 entry concerns hopetree izone lts, version c011b48, which contains a server-side request forgery (SSRF) in the active push function. The vulnerability is caused by inadequate input filtering in the internal functions push_urls() and get_urls() within apps/tool/apis/bd_push.py, ...