CVE-2020-28978

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF...

CVE-2020-28978: Server-Side Request Forgery (SSRF)

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF...

Canto <= 1.7.0 - Unauthenticated Blind SSRF

The plugin is affected by Blind SSRF issues via the domain parameter in three files: /includes/lib/tree.php, /includes/lib/detail.php and /includes/lib/get.php. All requests to the arbitrary domain/IP will be made with the HTTPS protocol PoC The PoC will be displayed once the issue has been...

CVE-2020-28977: Server-Side Request Forgery (SSRF)

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF...

CVE-2020-28976: Server-Side Request Forgery (SSRF)

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF...

ownCloud < 10.3.2 SSRF Vulnerability

ownCloud is prone to a server-side request forgery SSRF vulnerability in the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2020-13309

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature...

CVE-2020-13309

GitLab versions before 13.1.10, 13.2.8 and 13.3.4 are affected by a blind SSRF vulnerability via the repository mirroring feature. Root cause: SSRF in repository mirroring. Impact per documented data indicates high potential impact; remediation is upgrading to fixed versions (13.1.10+, 13.2.8+, 1...

CVE-2020-13309

Removed by vendor...

CVE-2020-13309: Server-Side Request Forgery (SSRF)

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature...

FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)

Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...

Mail.ru: Blind SSRF on http://info.ucs.ru/settings/check/

Blind SSRF in info.ucs.ru...

CVE-2020-9645

Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery ssrf vulnerability. Successful exploitation could lead to sensitive information disclosure...

kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update

kubernetes 1.12.10-1.0.12 - CVE-2020-10749: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements - CVE-2020-8555: Half-Blind SSRF in kube-controller-manager kubeadm-ha-setup 0.0.2-1.0.70 - Enhance image tag read to depend on kubeadm-registry.sh for CVE release...

BlockDev Sp. Z o.o: Blind SSRF at https://chat.makerdao.com/account/profile

Blind SSRF at https://chat.makerdao.com/account/profile...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

UBUNTU-CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10980: Server-Side Request Forgery (SSRF)

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

LY Corporation: Blind SSRF in social-plugins.line.me

LINE Social Plugins https://social-plugins.line.me/ is a service that provides LINE users with content sharing on the web. This Blind SSRF attack was caused by bypassing the DNS verification of the parameter value received. It could have made requests to internal servers or scanned internal netwo...