CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

SUSE CVE-2024-11168

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition lies in insufficient validation of requests on the server side, allowing attackers to execute SSRF attacks.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks using the user-defined URL address...

CVE-2024-49521

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could...

Security Bulletin: Due to use of Axios, IBM Event Processing is vulnerable to server-side request forgery

Summary Axios is used by IBM Event Processing frontend. CVE-2024-39338 Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relative URLs. By sending a specially...

CVE-2024-51785

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-51785 WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-10814

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10814

Technical details about CVE-2024-10814 are not provided in the supplied documents. Monitor official advisories for updates on affected products, impact, and fixes.

PT-2024-34911 · Unknown · I Thirteen Web Solution Responsive Filterable Portfolio

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Responsive Filterable Portfolio versions 1.0.0 through 1.0.22 Description: The issue is a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to perform Server Side Request Forgery. This can...

WordPress Code Embed plugin <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Max Boll b0lli in WordPress Plugin Code Embed versions = 2.5...

CVE-2024-50811

The CVE-2024-50811 entry concerns hopetree izone lts, version c011b48, which contains a server-side request forgery (SSRF) in the active push function. The vulnerability is caused by inadequate input filtering in the internal functions push_urls() and get_urls() within apps/tool/apis/bd_push.py, ...

Northern.tech Mender 安全漏洞

Northern.tech Mender is a secure and reliable remote update solution from Northern.tech, Inc. It is suitable for connected devices of any size. A security vulnerability exists in versions of Northern.tech Mender prior to 2024.07.11 that stems from the presence of a server-side request forgery...

WordPress Code Embed Plugin <= 2.5 is vulnerable to Server Side Request Forgery (SSRF)

Software Code Embed Type Plugin Vulnerable versions = 2.5 Fixed in 2.5.1 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-10814 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 4cf23fa82f5e Credits Max Boll b0lli Required privilege...

CVE-2024-48951

CVE-2024-48951 concerns Logpoint prior to 7.5.0, where a Server-Side Request Forgery (SSRF) on the SOAR component can be abused to disclose the system’s API token, resulting in authentication bypass. Affected product: Logpoint SOAR within the Logpoint platform (versions

CVE-2024-20531 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery SSRF attack through an affected device. To exploit this vulnerability, the attacker woul...

GHSA-3GF9-WV65-GWH9 gradio Server Side Request Forgery vulnerability

In gradio =4.42.0, the gr.DownloadButton function has a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resourc...