PT-2025-6606 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.4.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary...

CVE-2024-48346

xtreme1 = v0.9.1 contains a Server-Side Request Forgery SSRF vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems...

Xtreme1 安全漏洞

Xtreme1 is an all-in-one open source platform for multimodal training data open-sourced by Xtreme1. A security vulnerability exists in Xtreme1 v0.9.1 and earlier versions that stems from vulnerability to a server-side request forgery attack that allows an attacker to make arbitrary requests to...

PT-2024-19702 · Open Xchange Gmbh +1 · Ox App Suite

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

PT-2023-28780 · Moosocial · Moosocial

Name of the Vulnerable Software and Affected Versions: mooSocial version 3.1.8 Description: The issue concerns external service interaction on the post function. When executed, the server sends HTTP and DNS requests to an external server. The parameters affected are multiple, including messageTex...

Exploit for External Control of System or Configuration Setting in Moosocial

mooSocial: External HTTP and DNS Service Interaction CVE-2023...

PT-2023-16575 · Opennms · Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Horizon versions 31.0.8 through 32.0.2 Description: The issue is related to an XML external entity XXE injection vulnerability in the /rtc/post/ endpoint, which can be used to force Horizon to make arbitrary HTTP requests to internal...

UBUNTU-CVE-2023-27586

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

Kozea CairoSVG 代码问题漏洞

Kozea CairoSVG is a Python based software from the Kozea community that converts SVG files to PDF, EPS, PS and PNG files. A code issue vulnerability exists in Kozea CairoSVG versions prior to 2.7.0, which stems from the fact that Cairo can send requests to an external host when processing SVG...

SUSE CVE-2012-3488

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to...

Design/Logic Flaw

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources like third party servers. This could allow...

PT-2022-26178 · Dhis2 · Dhis2

Name of the Vulnerable Software and Affected Versions: DHIS2 versions prior to 2.36.12.1 DHIS2 versions prior to 2.37.8.1 DHIS2 versions prior to 2.38.2.1 DHIS2 versions prior to 2.39.0.1 Description: DHIS 2 is an open source information system for data capture, management, validation, analytics...

USN-5238-1 libpgjava vulnerability

It was discovered that PostgreSQL JDBC Driver incorrectly handled certain requests from external entities. A remote attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code...

PT-2022-4240 · Pki-Core +8 · Pki-Core +8

Name of the Vulnerable Software and Affected Versions: pki-core versions affected versions not specified Description: The issue is related to the incorrect restriction of XML external entities, which can lead to XML external entity XXE attacks. A remote attacker can potentially retrieve the conte...

CVE-2021-33705

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery SSRF vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request e.g. POST, G...

Arch Linux 代码问题漏洞

Arch Linux is an application system from Arch Open Source. A lightweight and flexible Linux® distribution that tries to keep it simple. A code issue vulnerability exists in Arch Linux that stems from a failure to adequately validate user-entered XML data, which could allow an attacker to pass...

WordPress Canto plugin 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A server-side request forgery vulnerability exists in WordPress Canto plugin 1.3.0. An attacker can...

TYPO3 Input Validation Error Vulnerability (CNVD-2020-65162)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...

TYPO3 代码问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...