508 matches found
BMC FootPrints 'feedUrl' - Server-Side Request Forgery
BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...
Memos 0.13.2 - Server-Side Request Forgery
SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...
basketcraft
basketcraft 这是一个利用 CVE-2023-27163 漏洞的脚本,该漏洞是 request-baskets 1.2.1 版本中的一个 SSRF。 SSRF on Request-Baskets CVE-2023–27163 CVE-2023–27163 是 Request-Baskets 中一个严重的服务端请求伪造(SSRF)漏洞,影响 1.2.1 及之前的所有版本。该漏洞使恶意行为者能够通过精心构造的 API 请求,利用 /api/baskets/name 组件,未经授权访问网络资源和敏感信息。 工作原理 Request-Baskets 是一个 Web...
CVE-2024-47066
CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ 描述 CVE-2024-47066 :Lobe Chat 是一个开源的人工智能聊天框架。在 1.19.13 版本之前,src/app/api/proxy/route.ts 中实现的服务器端请求伪造保护未考虑重定向,当攻击者提供外部的恶意 URL 重定向到内部资源(如私有网络或回环地址)时,可被绕过。1.19.13 版本包含了针对该问题的改进修复。 报告者 :a1loy...
CVE-2023-27163
Request-Baskets 上的 SSRF 概念验证 CVE-2023-27163 本仓库包含 CVE-2023-27163 的概念验证代码 PoC,该漏洞是 request-baskets 直至 1.2.1 版本 中存在的一个服务端请求伪造 SSRF 漏洞。攻击者可利用精心构造的 API 请求,通过 /api/baskets/name 组件访问网络资源和敏感信息。 使用方法 root@kitploit: git clone https://github.com/MasterCode112/CVE-2023-27163.git bash ./CVE-2023-27163.sh...
slipstream
NAT Slipstreaming NAT 滑流攻击 允许攻击者远程访问受害者 NAT 后方 任意系统 上的任何 TCP/UDP 服务,只需受害者访问一个网站即可绕过受害者的 NAT/防火墙(远程任意防火墙端口控制)。 v1 开发者 :@SamyKamkar // https://samy.pl v2 开发者 :Samy Kamkar && Ben Seri && Gregory Vishnipolsky of Armis。 阅读Ben 和 Gregory 关于 v2 的优秀技术文章,其中深入介绍了他们对 v2 的更新以及大量额外细节。 v1 发布日期 :2020年10月31日 👻 v2...
Review.CVE-2023-5612
CVE-2023-5612 – SSRF en GitLab mediante URL de Webhook PoC y análisis 📌 Resumen del CVE CVE-ID: CVE-2023-5612 Severidad: Alta CVSS: 8.1, puntuación base Tipo: Server-Side Request Forgery SSRF Componente: Webhooks de GitLab CE/EE Versiones afectadas: GitLab CE/EE " \ --data-urlencode...
CVE-2026-86321
A flaw was found in jackson-coreutils. This server-side request forgery SSRF vulnerability occurs when applications use the JsonLoader.fromURL function with untrusted input. A remote attacker can exploit this to induce the server to make arbitrary requests. This could lead to unauthorized...
CVE-2026-54054
Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...
CVE-2026-33752
CVE-2026-33752 CVE-2026-33752 SSRF basado en redirecciones que permite el acceso a la red interna en curlcffi Resumen curlcffi no restringe las solicitudes a rangos de IP internos y sigue las redirecciones automáticamente mediante la librería subyacente libcurl. Debido a esto, una URL controlada...
CVE-2021-36260
海康威视 CVE-2021-36260 RCE 漏洞 漏洞描述 攻击者利用该漏洞可以用无限制的 root shell 来完全控制设备,即使设备的所有者受限于有限的受保护 shell(psh)。除了入侵 IP 摄像头外,还可以访问和攻击内部网络。 FOFA root@kitploit: header="Hikvision" app="HIKVISION-视频监控" 使用方法 root@kitploit: python ./CVE-2021-36260.py -u http://192.168.1.1:8080 --check python ./CVE-2021-36260.py -u...
EUVD-2026-72786
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...
CVE-2026-86590
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...
CVE-2026-86590
Eclipse Che versions 7.79.0 through 7.121.0 contain a server-side request forgery (SSRF) in the dashboard backend's POST /dashboard/api/data/resolver endpoint. The endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering, and the operator-configured al...
EEF-CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforce...
hikvision-unauthenticated-rce-cve-2021-36260
海康威视 CVE-2021-36260 RCE 漏洞 漏洞描述 攻击者利用该漏洞可以用无限制的 root shell 来完全控制设备,即使设备的所有者受限于有限的受保护 shell(psh)。除了入侵 IP 摄像头外,还可以访问和攻击内部网络。 FOFA root@kitploit: header="Hikvision" app="HIKVISION-视频监控" 使用方法 root@kitploit: python ./CVE-2021-36260.py -u http://192.168.1.1:8080 --check python ./CVE-2021-36260.py -u...
Linux Distros Unpatched Vulnerability : CVE-2026-76177
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...
CVE-2026-76177
Ocsreports for OCS Inventory NG contains a Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint. The root cause is insufficient validation of the HTTPS_SERV and FILE_SERV parameters, allowing an authenticated user with operator privileges to supply ...
Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts...