WordPress Modern Events Calendar plugin <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery vulnerability

Authenticated Subscriber+ Server Side Request Forgery vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar versions = 7.12.1...

Journyx code issues and vulnerabilities

Journyx is a cloud-based time tracking software from Journyx. A code issue vulnerability exists in Journyx version 11.5.4 that stems from an XML body that allows SOAP requests to contain references to external entities, which could allow an unauthenticated attacker to read local files, perform...

WordPress plugin Modern Events Calendar has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

PT-2024-37934

Name of the Vulnerable Software and Affected Versions soap cgi.pyc affected versions not specified Description The issue allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources by including references to external entities...

httpd: Potential SSRF in mod_rewrite

A flaw was found in the modrewrite module of httpd. A potential SSRF allows an attacker to cause unsafe rules used in the RewriteRule directive to unexpectedly set up URLs to be handled by the modproxy module...

Microsoft Copilot Studio code-related vulnerabilities

Microsoft Copilot Studio is an artificial intelligence chatbot from Microsoft Corporation USA. A code issue vulnerability exists in Microsoft Copilot Studio that originates from an authenticated attacker who can bypass server-side request forgery SSRF protections, resulting in the disclosure of...

PT-2024-29889 · Nuxt · Nuxt

Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 1.4.5 Description: The nuxt/icon API endpoint, located at /api/ nuxt icon/name, is vulnerable to improper parsing of the proxied request path, allowing an attacker to change the scheme and host of the request. This lead...

Apache IoTDB code-related vulnerabilities

Apache IoTDB is an integrated data management engine designed for time-series data from the Apache USA Foundation, which provides data collection, storage, and analysis services, among other things. Apache IoTDB suffers from a server-side request forgery vulnerability that stems from the product'...

PT-2024-28648

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 6.10.1 Description A Server-Side Request Forgery SSRF issue affects Rocket.Chat's Twilio webhook endpoint. This allows attackers to redirect requests, potentially risking sensitive data. Approximately 1781 IPs hav...

Rocket.Chat security vulnerability

Rocket.Chat is a chat program from Rocket.Chat, Inc. A security vulnerability exists in Rocket.Chat versions prior to 6.10.1 that stems from a server-side request forgery vulnerability in the Twilio network hook endpoint...

WADL SSRF

The vulnerability of the WADL Web Application Description Language framework for Apache CXF lies in the possibility of modifying requests on the server side due to incorrect transformation of style sheets. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack...

CVE-2024-2090

The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remotecontent shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary...

CVE-2024-7330

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

WordPress plugin Remote Content Shortcode has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress plugin Remote Content...

PT-2024-28573 · Edubin · Edubin

Name of the Vulnerable Software and Affected Versions: Edubin versions 9.2.0 and earlier Description: The issue is a Server Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, which could lead to various security...

CVE-2024-6980

A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise...

YouDianCMS code-related vulnerabilities

YouDianCMS YouDian CMS is a website builder from China YouDian Company. A code issue vulnerability exists in YouDianCMS version 7, which stems from the parameter url in the file curlexec /App/Core/Extend/Function/ydLib.php that can lead to server-side request forgery...

PT-2024-29352 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.4.3 Description: A Server-Side Request Forgery SSRF issue in the Plugins Page allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

WonderCMS security vulnerabilities

WonderCMS is a PHP-based open source content management system CMS from WonderCMS. A server-side request forgery vulnerability exists in WonderCMS version 3.4.3, which stems from a failure to properly validate user input in the Plugins Page, and can be exploited by an attacker to force the...

GLPI Falsifying Requests Redirect

The vulnerability in the GLPI system for handling requests and incidents is related to the possibility of forged requests on the server side. Exploiting this vulnerability allows a malicious actor to redirect users to an arbitrary URL address...