11522 matches found
CVE-2022-3708 Web Stories <= 1.24.0 - Server Side Request Forgery
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...
WordPress Blog2Social server-side request forgery vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Blog2Social version before 6.9.10...
PT-2022-6234 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive...
CVE-2022-43776
The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...
Server side request forgery (ssrf)
The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...
CVE-2022-43776
The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...
CVE-2022-36451
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery SSRF attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage...
CVE-2022-36451
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery SSRF attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage...
Server side request forgery (ssrf)
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery SSRF attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors...
Server side request forgery (ssrf)
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...
CVE-2022-27622
The CVE-2022-27622 entry concerns Synology DiskStation Manager (DSM) with a Server-Side Request Forgery (SSRF) in the Package Center before version 7.1-42661. Affected component: DSM Package Center; root cause: SSRF allowing remote authenticated users to access intranet resources via unspecified ...
CVE-2022-27622
Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors...
CVE-2022-3247 Blog2Social < 6.9.10 - Subscriber+ SSRF
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks...
PT-2022-21335 · WordPress · Blog2Social
Name of the Vulnerable Software and Affected Versions: Blog2Social: Social Media Auto Post & Scheduler WordPress plugin versions prior to 6.9.10 Description: The issue allows any authenticated users, such as subscribers, to perform SSRF Server-Side Request Forgery attacks due to the lack of...
CVE-2022-36451
The CVE-2022-36451 vulnerability affects Mitel MiCollab, specifically the MiCollab Client server component up to version 9.5.0.101. The issue is a Server-Side Request Forgery (SSRF) caused by insufficient restriction of URL parameters, enabling an authenticated attacker to leverage the host serve...
CVE-2022-36451
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery SSRF attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage...
CVE-2022-36451
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery SSRF attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage...
