CVE-2020-7126

A remote server-side request forgery ssrf vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

CVE-2020-7126

A remote server-side request forgery ssrf vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel

Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...

W3 Total Cache Plugin for WordPress < 0.9.5 Server-Side Request Forgery

The WordPress W3 Total Cache Plugin installed on the remote host is affected by a server-side request forgery SSRF vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reporte...

Server side request forgery (ssrf)

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...

PT-2020-16089

Name of the Vulnerable Software and Affected Versions CRMEB version 3.0 Description A SSRF issue exists in the downloadimage interface, allowing remote download of arbitrary files on the server and potentially enabling remote execution of arbitrary code. Recommendations For CRMEB version 3.0,...

BigBlueButton 2.2.25 File Disclosure / Server-Side Request Forgery

Advisory: Arbitrary File Disclosure and Server-Side Request Forgery in BigBlueButton RedTeam Pentesting discovered a vulnerability in the BigBlueButton web conferencing system which allows participants of a conference with permissions to upload presentations to read arbitrary files from the file...

Server side request forgery (ssrf)

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

Server side request forgery (ssrf)

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-7749

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...

CVE-2020-7749 Server-side Request Forgery (SSRF)

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

OX App Suite / OX Documents 7.10.3 XSS / Server-Side Request Forgery

Product: OX App Suite / OX Documents Vendor: OX Software GmbH Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.2, 7.10.3 Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.2-rev29, 7.10.3-rev15 Vendor notificatio...

GitHub Security Lab: Java: CWE-918 - Server Side Request Forgery (SSRF)

This bug was reported directly to GitHub Security Lab...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4365)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2020-4772

An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...

Xxe

An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...

CVE-2020-4772

An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...

CVE-2020-4772

The CVE-2020-4772 XXE vulnerability affects IBM Cúram Social Program Management (Curam SPM) 7.0.9 and 7.0.10. The root cause is an XML External Entity Injection flaw in Curam SPM components, leading to potential exposure of sensitive data and the possibility of DoS, SSRF, or memory/resource exhau...

Security Bulletin: IBM InfoSphere Metadata Asset Manager is vulnerable to stored cross-site scripting and server-side request forgery.

Summary Stored cross-site scripting and server-side request forgery vulnerabilities in IBM InfoSphere Metadata Asset Manager was addressed. Vulnerability Details CVEID: CVE-2020-4702 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to stored cross-site scripting. This vulnerability...