Security Bulletin: server-side request forgery vulnerability in Apache CXF (CVE-2022-46364) may affect CICS TX Advanced

Summary CICS TX Advanced has addressed a vulnerability in Apache CXF CVE-2022-46364. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using a...

Security Bulletin: IBM QRadar Wincollect agent is vulnerable to server side request forgery (SSRF) (CVE-2022-43879)

Summary IBM QRadar Wincollect agent is vulnerable to server side request forgery. IBM QRadar WinCollect for IBM QRadar SIEM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2022-43879 DESCRIPTION: IBM Jazz Foundation is vulnerable to server-side request forgery SSRF. This may...

CVE-2023-27161

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery SSRF via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

CVE-2023-27161

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery SSRF via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

PT-2023-20981 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions up to 10.7.7 Description: The issue allows attackers to access network resources and sensitive information via a crafted POST request to the /Repositories component, enabling Server-Side Request Forgery SSRF. This can lead t...

CVE-2023-27161

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery SSRF via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

Security Bulletin: IBM Liberty for Java for IBM Cloud is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)

Summary There is a vulnerability in the Apache CXF library used by IBM Liberty for Java for IBM Cloud with the jaxws-2.2 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in...

@leifermendez/partytown-qwik (>=1.0.3, <=1.0.7), cypress-ct-jordan-qwik (>=0.0.0-alpha-10, <=0.0.0-alpha-9) +1 more potentially affected by CVE-2023-1283 via @builder.io/qwik (>=0.9.0, <=0.18.1)

@builder.io/qwik NPM version =0.9.0, =1.0.3, =0.0.0-alpha-10, =0.0.0-alpha-9 - storybook-framework-qwik 0.0.1 Source cves: CVE-2023-1283 Source advisory: OSV:GHSA-9WF9-QVVP-2929...

Debian: Security Advisory (DLA-695-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GiveWP < 2.25.2 - Admin+ Server-Side Request Forgery

The plugin does not validate a parameter before making a request to it, which could allow users with a role of Administrator to perform an SSRF attack...

AJ-Report Server-Side Request Forgery Vulnerability

AJ-Report is a completely open source BI platform. AJ-Report version 0.9.8.6 suffers from a server-side request forgery vulnerability that can be exploited by an attacker to perform a server-side request forgery attack...

PT-2023-19995 · Loonflow · Loonflow

Name of the Vulnerable Software and Affected Versions: loonflow version r2.0.14 Description: A Server-Side Request Forgery SSRF issue allows attackers to force the application to make arbitrary requests via manipulation of the hook url parameter. This enables attackers to potentially access...

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Server side request forgery (ssrf)

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk...

Directus vulnerable to Server-Side Request Forgery On File Import

Summary Directus versions =9.22.4 is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack a...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

Server side request forgery (ssrf)

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...