PT-2023-30325 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.3 Discourse version 3.2.0.beta3 and earlier in the beta and tests-passed branches Description: Discourse is an open source platform for community discussion. The embedding feature is susceptible to server side...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from the fact that the embedding functionality is susceptible to server-side request forgery...

CVE-2023-39301

A server-side request forgery SSRF vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS...

foodcoopshop Code Issues Vulnerabilities

foodcoopshop is foodcoopshop open source an open source software for food co-ops and stores. A code issue vulnerability exists in foodcoopshop versions prior to 3.6.1, which stems from vulnerability to server-side request forgery attacks...

PT-2023-25368 · Ibm · Ibm Content Navigator

Name of the Vulnerable Software and Affected Versions: IBM Content Navigator version 3.0.13 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a server-side...

The vulnerability of the /v1/avatars/favicon component of the backend platform for developing mobile and web applications allows a attacker to perform an SSRF attack.

The vulnerability of the /v1/avatars/favicon component in the backend platform for developing mobile and web applications relates to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially crafted GET request...

PT-2023-29919 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10 Description: A server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files...

CVE-2023-46502

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory...

GeoServer 代码问题漏洞

GeoServer is an open source software server written in Java. Allows users to share and edit geospatial data. GeoServer suffers from a server-side request forgery vulnerability that stems from the fact that the OGC Web Processing Service WPS specification is designed to process information from an...

PT-2023-29857

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides web application is vulnerable to a Server-Side Request Forgery SSRF attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing...

PT-2023-29777 · Umputun · Remark42

Name of the Vulnerable Software and Affected Versions: umputun remark42 versions 1.12.1 and before Description: The issue is related to a Blind Server-Side Request Forgery SSRF vulnerability. No information is provided about the estimated number of potentially affected devices worldwide or...

Fortinet FortiAnalyzer Code Issue Vulnerability

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is primarily used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in the logs through the Reporting...

PT-2023-24019

Name of the Vulnerable Software and Affected Versions Langchain versions 0.0.0 through 0.0.155 Langchain versions prior to 0.0.329 Description The issue allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing Server-Side Request Forgery SSRF and...

CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

PYSEC-2023-205

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

PYSEC-2023-205

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

Apache ShenYu 代码问题漏洞

Apache ShenYu is an asynchronous , high-performance , cross-language , responsive API gateway of the United States Apache Apache Foundation . A server-side request forgery vulnerability exists in Apache ShenYu version 2.5.1, which stems from a failure of the sandbox/proxyGateway endpoint to...

PT-2023-28155 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home assistant versions prior to 2023.9.0 Description: The issue concerns a partial Server-Side Request Forgery vulnerability in the hassio.addon stdin service, where an attacker capable of calling this service may be able to invoke any...

PT-2023-29915

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.0.317 Description The issue allows Server-Side Request Forgery SSRF via the document loaders/recursive url loader.py module. This occurs because crawling can proceed from an external server to an internal server...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce stores relates to insufficient verification of incoming requests. This allows attackers to carry out SSRF attacks.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce stores is related to insufficient verification of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP...