22392 matches found
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7
New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9
New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8
New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
patch-CVE-2026-15502
패치: CVE-2026-15502 취약점 세부 정보 CVE : CVE-2026-15502 제품 : Microsoft Exchange Server 설명 : RCE로 이어지는 SSRF 심각도 : 치명적 패치 상태: 검토 중 필드| 값 ---|--- 패치 날짜| 2026-06-01 상태| 검토 중 배포 대상| 프로덕션 검증자| SecOps 팀 참고 자료 NVD CISA KEV...
CVE-2026-40564
CVE-2026-40564: flink-kubernetes-operator의 FlinkSessionJob.spec.job.jarURI를 통한 SSRF Apache Flink Kubernetes Operator는 FlinkSessionJob또는 FlinkDeployment 리소스의 spec.job.jarURI 필드를 확인하지 않습니다. 이러한 리소스 중 하나를 생성할 수 있는 사람은 누구나 jarURI를 임의의 URL로 설정할 수 있습니다. 운영자가 리소스를 조정reconcile하면 자신의 파드 내부에서 해당 URL을 가져옵니다...
CVE-2026-34207
CVE-2026-34207 Фильтр SSRF проверял текст имени хоста, но фактический адрес назначения определялся позже через DNS. Этот разрыв позволил URL-адресам вебхуков, контролируемым атакующим, достигать loopback, метаданных и частных сетевых целей. Введение Я обнаружил эту проблему во время проверки...
cosmicsting-cve-2024-34102-exploit
Набор эксплойтов CosmicSting CVE-2024-34102 Полный набор эксплойтов для CVE-2024-34102 — уязвимость XXE CosmicSting в Adobe Commerce / Magento 2.4.x. Детали уязвимости CVE : CVE-2024-34102 CVSS 9.8 Тип : Внедрение внешних XML-сущностей XXE Воздействие : Неавторизованное удаленное чтение файлов,...
SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities
1 CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this...
Server-Side Request Forgery (SSRF)
org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...
CVE-2026-39728
Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...
CVE-2026-39719
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
EUVD-2026-93250
Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...
CVE-2026-39728
The Instapage Plugin for WordPress is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in versions
CVE-2026-39728 WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...
