WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Zaidan Rizaki Patchstack Alliance in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.3.9.8...

Lobe Chat code issue vulnerabilities

Lobe Chat is an open source, high-performance chatbot framework open-sourced by LobeHub. A code issue vulnerability exists in Lobe Chat versions prior to 1.19.13, which stems from vulnerability to server-side request forgery attacks that could allow an attacker to launch an attack without logging...

Butterfly SSRF

The vulnerability of the Butterfly web application development tool is related to an incorrect limitation on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to perform a SSRF attack remotely...

CVE-2024-38645

A server-side request forgery SSRF vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later...

IPC Unigy Management System security vulnerabilities

IPC Unigy Management System is an integrated trading platform from IPC Inc. It is used to monitor, manage and maintain the trading communications infrastructure. A security vulnerability exists in IPC Unigy Management System version 04.03.00.08.0027. An attacker could exploit this vulnerability t...

PT-2024-17139 · Ipc · Ipc Unigy Management System

Name of the Vulnerable Software and Affected Versions: IPC Unigy Management System version 04.03.00.08.0027 Description: A critical issue was found in the HTTP Request Handler component, which can lead to server-side request forgery. This issue can be exploited remotely. The exploit has been...

Eclipse Jetty SSRF

The vulnerability of the HttpURI class in Eclipse Jetty’s server container is related to improper syntax validation during input processing. Exploiting this vulnerability allows an attacker to perform an SSRF attack remotely...

Apache OFBiz SSRF

The vulnerability of Apache OFBiz’s resource planning software lies in improper code generation management. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...

PT-2024-40094 · Vm2 +1 · Vm2 +1

Name of the Vulnerable Software and Affected Versions: Flowise affected versions not specified Description: The issue allows developers to inject configuration into the Chainflow during execution through the overrideConfig option, which is supported in both the frontend web integration and the...

Red Hat OpenShift Console code-related vulnerabilities

Red Hat OpenShift Console is an OpenShift console from Red Hat USA. A code issue vulnerability exists in Red Hat OpenShift Console, which stems from the vulnerability of the component openshift4/ose-console to a server-side request forgery attack, which allows an authenticated user to make the...

PT-2024-8600 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to Server-Side Request Forgery SSRF and Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This vulnerability may allow a remote...

DEBIAN-CVE-2021-3902

An improper restriction of external entities XXE vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery SSRF and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to...

Dompdf code issue vulnerabilities

Dompdf is a Dompdf open source HTML to PDF converter . A code issue vulnerability exists in Dompdf versions prior to 2.0.0, which stems from the presence of an improper restriction of the External Entity XXE vulnerability, which could lead to server-side request forgery SSRF and deserialization...

CVE-2024-5917

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

Palo Alto Networks PAN-OS code-related vulnerabilities

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A code issue vulnerability exists in Palo Alto Networks PAN-OS that stems from a server-side request forgery vulnerability that could allow an unauthenticated attacker to use the...

PT-2024-37239 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS affected versions not specified Description: A server-side request forgery in PAN-OS software enables an attacker to use the administrative web interface as a proxy, allowing them to view internal network resources not otherwise...

Adobe Commerce security vulnerabilities

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. A security vulnerability exists in Adobe Commerce version 3.2.5 and prior versions, which stems from the inclusion of a server-side request forgery vulnerability that could lead to a security feature...

HPESBNW04726 rev.1 - HPE Telco IP Mediation Application, Multiple Vulnerabilities

Potential Security Impact: Local: Unauthenticated Arbitrary Code Execution, Server-Side Request Forgery SSRF, local memory corruption, Host Header Injection; Remote: Denial of Service DoS, SQL Injection, Server-Side Request Forgery SSRF, memory corruption, unathorized modification, Input Validati...

PT-2024-8162 · Sap · Sap Web Dispatcher

Name of the Vulnerable Software and Affected Versions: SAP Web Dispatcher versions prior to the November 2024 Patch Day Description: An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input da...

CVE-2024-50811

hopetree izone lts c011b48 contains a server-side request forgery SSRF vulnerability in the active push function as \apps\tool\apis\bdpush.py does not securely filter user input through pushurls and geturls...