9724 matches found
Server-Side Request Forgery (SSRF)
graphite-web is vulnerable to server-side request forgery SSRF. The sendemail function in graphite-web/webapp/graphite/composer/views.py can be used by an attacker to send a request on behalf of the Graphite web server. The corresponding response from the SSRF request is encoded into an image fil...
CVE-2019-17669
WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...
Server side request forgery (ssrf)
WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...
CVE-2019-17669
WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...
WordPress 4.9.x < 4.9.12 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...
WordPress 3.8.x < 3.8.31 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...
WordPress 4.2.x < 4.2.25 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...
WordPress 4.3.x < 4.3.21 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...
WordPress 4.0.x < 4.0.28 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...
WordPress < 5.2.4 Multiple Vulnerabilities
According to its self-reported version number, the WordPress application running on the remote web server is affected by multiple vulnerabilities: - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated,...
wordpress -- multiple issues
wordpress developers reports: Props to Evan Ricafort for finding an issue where stored XSS cross-site scripting could be added via the Customizer. rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts. Props to Weston Ruter for finding a way to create a stored XSS ...
Server side request forgery (ssrf)
Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had...
CVE-2017-7553
The externalrequest api call in App Studio millicore allows server side request forgery SSRF. An attacker could use this flaw to probe the network internal resources and access restricted endpoints...
PRODSECBUG-2309: Server-side request forgery via crafted connector endpoint
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
Server-Side Request Forgery (SSRF)
libpcap.so is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists because rpcapd/daemon.c does not properly handle the opening of remote devices when provided with a URL as a capture source, allowing an attacker to submit requests on behalf of the server...
Server side request forgery (ssrf)
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source...
WordPress Visualizer Plugin < 3.3.1 Multiple Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113537";...
Server-side Request Forgery in Zingbox Inspector
A security vulnerability exists in the Zingbox Inspector that can allow an attacker to easily identify instances of Zingbox Inspectors in a local area network. Ref: CVE-2019-15021 The vulnerability allows for an attacker to easily identify any running instances of Zingbox Inspector on a local are...
XML External Entity (XXE)
selenium-firefox-driver is vulnerable to XML external entity attacks. External DTD declarations are not disabled, allowing a remote attacker to perform server-side request forgery attacks, local port scanning, access system files and possibly a denial of service attack...
