CVE-2018-1000138

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources...

CVE-2018-1000138: Server-Side Request Forgery (SSRF)

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources...

NoneCms Server-Side Request Forgery Vulnerability

NoneCms is an open source CMS Content Management System for quickly building corporate websites, personal blogs and supporting mobile. A cross-site request forgery vulnerability exists in the 'copy' function of the application/admin/controller/Article.php file in NoneCms version 1.3.0, which stem...

Atlassian Jira Information Disclosure Vulnerability

Atlassian Jira is a defect tracking management system, a commercial application for defect management, task tracking and project management. An information disclosure vulnerability exists in the Trello import program in Atlassian Jira. A remote attacker could exploit this vulnerability to access...

CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

CVE-2017-0301

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application...

CVE-2017-0301

CVE-2017-0301 affects F5 BIG-IP APM in versions 11.5.0–12.1.2 where portal access requests may not return the intended resources, potentially allowing access to internal BIG-IP APM resources while application and backend resources remain unaffected. The vulnerability is documented by F5 in K54358...

CVE-2017-0301: Undefined Security Weakness

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application...

The vulnerability of the dynamic analyzer for XML files in the wsisapi.dll library of the enterprise automation system 1C:Enterprise allows a perpetrator to cause service failures and gain access to internal network resources.

The vulnerability of the dynamic analyzer for XML files in the wsisapi.dll library of the enterprise automation system 1C:Enterprise is related to the implementation of XML. Exploiting this vulnerability can allow a malicious actor to cause service failures and gain access to internal network...

CVE-2017-7553

The externalrequest api call in App Studio millicore allows server side request forgery SSRF. An attacker could use this flaw to probe the network internal resources, and access restricted endpoints...

CVE-2017-7553

The externalrequest api call in App Studio millicore allows server side request forgery SSRF. An attacker could use this flaw to probe the network internal resources, and access restricted endpoints...

PT-2017-17796 · Millicore · App Studio

Name of the Vulnerable Software and Affected Versions: App Studio millicore affected versions not specified Description: The issue allows for server side request forgery SSRF through the external request API call. This could enable an attacker to probe internal network resources and access...

Per app VPN for android - Cannot connect to internal resources.

After setting up per app VPN for android, the customer is unable to connect to internal resources. Google chrome launches but page comes up in a blank white screen .. VPN connections shows as not sending or receiving packets...

Atlassian OAuth Server-Side Request Forgery Vulnerability

Atlassian OAuth Plugin is an authorization plugin from Atlassian Australia for accessing personal Atlassian software data. A security vulnerability exists in the IconUriServlet in the Atlassian OAuth Plugin. A remote attacker could exploit the vulnerability to access internal network resources or...

Synology Chat Server-Side Request Forgery Vulnerability

Synology Chat is a live chat tool from Synology. link preview is one of the link preview components. A server-side request forgery vulnerability exists in link preview in Synology Chat versions prior to 1.1.0-0806. A remote attacker can exploit this vulnerability to gain access to internal...

Per App VPN with Citrix Endpoint Management and XenMobile

You can configure the per-app VPN feature to establish connection to internal resources in full VPN mode...

Microsoft Edge allows remote attackers to bypass the Same Origin Policy（CVE-2017-0002）

Original link: UXSS on Microsoft Edge – Adventures in a Domainless World without domain big World Adventure Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Note: the associated file can be downloaded here in. Today, we discuss the design of problems, with these...

IBM Forms Experience Builder Server-Side Request Forgery Security Bypass Vulnerability

IBM Forms Experience Builder is a set of U.S. IBM's Web forms for creating Web site applications. A server-side request forgery vulnerability exists in IBM Forms Experience Builder versions 8.5, 8.5.1, and 8.6. An attacker could exploit this vulnerability to obtain information about internal...

Server side request forgery (ssrf)

IBM Forms Experience Builder could be susceptible to a server-side request forgery SSRF from the application design interface allowing for some information disclosure of internal resources...