PT-2019-11325 · Jenkins · Jenkins Jms Messaging Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JMS Messaging Plugin versions 1.1.1 and earlier Description: A server-side request forgery issue exists that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint. This is due to vulnerabilities in th...

Atlassian JIRA Server-Side Request Forgery Vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A server-side request forgery vulnerability exists in the VerifyPopServerConnection resource in Atlassian JIRA, which can be...

CVE-2019-1679

A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server VCS Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack ...

PT-2019-11318 · Jenkins · Jenkins Kanboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Kanboard Plugin versions 1.5.10 and earlier Description: A server-side request forgery issue exists that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL, potentially leading to...

CVE-2018-15657

An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...

CVE-2018-19858

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML file e.g., in an IFRAME element, PrinceXML will fetch the XML and parse it, thus giving an attacker file-read access and full-fledged SSRF...

CVE-2018-12609

OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery...

GHSA-9MXF-G3X6-WV74 Server-Side Request Forgery (SSRF) in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

Zoho ManageEngine ADSelfService Plus Server-Side Request Forgery Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A server-side request forgery vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions prior to 5.x build 5703, which can be exploited by an attacker to perform a server-side request...

CVE-2019-3905

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...

Jspxcms Server-Side Request Forgery Vulnerability

Jspxcms is a scalable enterprise-class open source web content management system CMS. A server-side request forgery vulnerability exists in Jspxcms version 9.0.0. No detailed vulnerability details are provided at this time...

CVE-2018-20528

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter...

CVE-2018-20463

An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF...

CVE-2018-1000827

Ubilling version = 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

DEBIAN-CVE-2018-1000832

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

PT-2018-9544 · Neo4J Contrib · Neo4J-Apoc-Procedures

Name of the Vulnerable Software and Affected Versions: neo4j-contrib neo4j-apoc-procedures versions before commit 45bc09c Description: The issue is related to a XML External Entity XXE vulnerability in the XML Parser. This can result in disclosure of confidential data, denial of service,...

Subsonic Server-Side Request Forgery Vulnerability

Subsonic is a media file hosting platform. A request forgery vulnerability exists on the server side of Subsonic. The vulnerability is located in the "internetRadioSettings.view" module and in the "streamUrl" parameter of the localhost path URL. This could allow a remote attacker to hijack the...

GitLab CE/EE Server-Side Request Forgery Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. A server-side request forgery...

UBUNTU-CVE-2018-18646

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF...

D-LINK Central WifiManager CWM-100 Server-Side Request Forgery Vulnerability

D-LINK Central WifiManager CWM-100 is D-LINK centralized wireless management software. The MailConnect feature on the D-Link Central WiFiManager CWM-100 1.03 r0098 device is used to check connections to SMTP servers, but actually allows outbound TCP to any port on any IP address, resulting in SSR...