210 matches found
CVE-2021-25939
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...
CVE-2021-35233
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client...
CVE-2021-29431
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perfor...
Matrix Sydent 代码问题漏洞
Matrix Sydent is an implementation of the Matrix Authentication Server API from the Matrix.org Foundation in the UK. Sydent suffers from a security vulnerability that stems from a lack of parameter validation or IP address blacklisting, which could cause Sydent to send HTTP GET requests to intern...
CVE-2021-21273
Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...
PT-2021-4083
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.5 and later Description A server-side request forgery vulnerability in GitLab CE/EE allows an unauthenticated attacker to exploit the issue when requests to the internal network for webhooks are enabled. This...
CVE-2020-13650
An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery SSRF that allows use of the application as a proxy. Sent to an external server, a forged request discloses application credentials. For a request to ...
PT-2020-9991
Name of the Vulnerable Software and Affected Versions: OX App Suite versions through 7.10.2 Description: The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external systems. No information is...
Stripo Inc: SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXX
Summary: SSRF vulnerability allows mapping the internal network. Steps To Reproduce: It is possible to run internal requests with the siteInfoLookup service. GET /cabinet/stripeapi/v1/siteInfoLookup?url=http://10.0.0.100:8080 HTTP/1.1 Host: my.stripo.email Based on the response we know if the ip ...
