CVE-2024-5482

CVE-2024-5482 describes a Server-Side Request Forgery in the Parisneo/Lollms-WebUI - specifically the add_webpage/add webpage endpoint. The issue arises from insufficient URL validation, allowing attackers to supply arbitrary URLs (including localhost/127.0.0.1) and trigger unauthorized requests ...

PT-2024-36425 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest Description: A Server-Side Request Forgery SSRF vulnerability exists in the "add webpage" endpoint, allowing attackers to input arbitrary URLs, including those targeting internal resources such as localhos...

PT-2024-30854 · Jenkins +1 · Cas +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to a lack of validation for a parameter before making a request to it. This could allow unauthenticated users to perform a Server-Side Request Forgery SSRF attack. SSR...

CVE-2021-47361

In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcballocbus There are two bugs: 1 If idasimpleget fails then this code calls putdevicecarrier but we haven't yet called getdevicecarrier and probably that leads to a use after free. 2 After...

PT-2024-25011 · Lobe Chat · Lobe Chat

Name of the Vulnerable Software and Affected Versions: Lobe Chat versions prior to 0.150.6 Description: The issue is related to an unauthorized Server-Side Request Forgery SSRF vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause SSRF without logging in,...

CVE-2024-23336

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list $config'disallowedremoteaddresses'...

CVE-2024-23336

CVE-2024-23336 concerns MyBB (prior to 1.8.38) where the default Disallowed Remote Addresses list did not include 127.0.0.0/8, enabling potential SSRF against internal resources. The issue stems from the configuration in inc/config.php where disallowed_remote_addresses contains 127.0.0.1 but omit...

CVE-2024-23336 Incomplete disallowed remote addresses list in MyBB

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list $config'disallowedremoteaddresses'...

PT-2024-19817 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.38 Description: The default list of disallowed remote hosts in MyBB does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF issue. The Configuration File's Disallowed Remote...

PT-2024-25386 · Unknown · Cusmin Absolutely Glamorous Custom Admin

Name of the Vulnerable Software and Affected Versions: Cusmin Absolutely Glamorous Custom Admin versions through 7.2.2 Description: A Server-Side Request Forgery SSRF issue affects the software, allowing unauthorized access to internal resources. This can lead to sensitive data exposure or other...

PT-2024-4001 · Portainer +1 · Portainer +1

Name of the Vulnerable Software and Affected Versions: Portainer versions prior to 2.20.0 Description: The issue is related to the use of open redirects in the Portainer container management platform. This could allow an attacker to redirect a user to an arbitrary site. The problem is associated...

The vulnerability of the GlobalProtect firewall’s PAN-OS operating system allows a hacker to impersonate another user and send network packets to internal resources.

The vulnerability of the GlobalProtect firewall’s PAN-OS operating system is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to impersonate another user and send network packets to internal resources...

PT-2024-22119 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue is related to insufficient input validation, allowing an attacker to send a crafted request from a vulnerable web application to target internal systems behind firewalls. Th...

GHSA-3Q6G-QMPX-RQW4 Whoogle Search Server-Side Request Forgery vulnerability

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...

PYSEC-2024-18

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...

PYSEC-2024-20

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

CVE-2023-6570

A Server-Side Request Forgery SSRF flaw was found in kubeflow. Any user can use kubeflow as a proxy to access internal or external resources and have the response returned to the user by supplying a url to the namespace parameter in /pipeline/artifacts/get. This issue could allow an attacker to...

Kubeflow Code Issues Vulnerabilities

Kubeflow is a cloud-native platform open-sourced by Kubeflow. A code issue vulnerability exists in Kubeflow that stems from the fact that any user can use Kubeflow as a proxy to access internal and external resources and return the requested response to the user...

VulnCheck KEV: CVE-2019-8451

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF vulnerability due to a logic bug in the JiraWhitelist class...

Dell Rugged Control Center Security Vulnerability

Dell Rugged Control Center is an application from Dell USA. It allows a range of settings to be configured on a ruggedized device, such as application settings, keyboard backlighting settings, night mode settings, stealth mode settings, window settings, antenna switch settings, and GPS settings. ...