CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

Airspan Networks Mmp 代码问题漏洞

Airspan Networks Mmp is an advanced standalone network management software platform for Mimosa fixed wireless devices from Airspan Networks, U.S.A. The Airspan Networks Mmp server-side request forgery vulnerability can be exploited by attackers to force the server to create and execute Web reques...

CLSA-2022-1643747448 Fix of CVE: CVE-2021-26690, CVE-2021-30641, CVE-2021-40438

CVE-2021-40438: modproxy: SSRF via a crafted request uri-path - CVE-2021-30641: MergeSlashes regression - CVE-2021-26690: modsession NULL pointer dereference in parser...

CVE-2022-0339

Server-Side Request Forgery SSRF in Pypi calibreweb prior to 0.6.16...

PYSEC-2022-23

Server-Side Request Forgery SSRF in Pypi calibreweb prior to 0.6.16...

PT-2022-13115 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: calibreweb versions prior to 0.6.16 Description: The issue is related to a Server-Side Request Forgery SSRF in calibreweb. This allows an attacker to forge requests from the server to other services. No information is provided about the...

Calibre-Web 代码问题漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. Calibre-Web suffers from a code issue vulnerability that stems from server-side request forgery SSRF in Pypi calibreweb before 0.6.16...

CVE-2021-36349

Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts...

Dell Emc Data Protection Central 代码问题漏洞

Dell Emc Data Protection Central is a management console from Dell USA Inc. It is used for data protection. A server-side request forgery vulnerability exists in Dell EMC Data Protection Central 19.5 and prior versions, which stems from the product's failure to properly validate user input and ca...

CVE-2021-23664

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...

PeerTube 代码问题漏洞

PeerTube is a decentralized video sharing service platform. PeerTube suffers from a server-side request forgery vulnerability that stems from the product's failure to properly validate user input, which can be exploited by attackers to probe server intranet resources...

PartKeepr 代码问题漏洞

PartKeepr is an inventory management software designed primarily for electronic components.PartKeepr suffers from a server-side request forgery vulnerability, which stems from the fact that the ability to upload attachments using a URL when creating a part does not validate whether a request can ...

CVE-2022-0132

peertube is vulnerable to Server-Side Request Forgery SSRF...

GHSA-2H63-QP69-FWVW Server-side request forgery (SSRF) in Apache Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

GHSA-MPP5-2X55-49XW XSS in svg2png (NPM package)

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document...

pikachu

It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to simulate various web application vulnerabilities, including but not limited to: Burt Force brute force, XSS cross-site scripting, CSRF cross-site request...

Apache Kylin 代码问题漏洞

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache kylin has a server-side request forgery vulnerability, which ste...

CVE-2022-0086

uppy is vulnerable to Server-Side Request Forgery SSRF...

Uppy 代码问题漏洞

Uppy is an open source file uploader for web browsers from Transloadit Open Source. A code issue vulnerability exists in uppy that allows an attacker to conduct server-side request forgery SSRF attacks...

OESA-2021-1473 httpd security update

Apache HTTP Server. Security Fixes: A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket...