FlatCore CMS Server-Side Request Forgery (CVE-2021-41403)

A server-side request forgery vulnerability exists in FlatCore CMS. Successful exploitation of this vulnerability could allow an attacker to access internal resources...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

Mozilla: CSP bypass enabling stylesheet injection

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker that can inject CSS into stylesheets accessible via internal URIs, such as resources. In doing so, they can bypass a page's Content Security Policy...

CVE-2022-1379

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery SSRF. This allows accessing restricted internal resources/servers or...

UBUNTU-CVE-2022-1379

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery SSRF. This allows accessing restricted internal resources/servers or...

Server side request forgery (ssrf)

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery SSRF. This allows accessing restricted internal resources/servers or...

CVE-2022-1379 URL Restriction Bypass in plantuml/plantuml

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery SSRF. This allows accessing restricted internal resources/servers or...

PT-2022-13841 · Plantuml · Plantuml

Name of the Vulnerable Software and Affected Versions: plantuml/plantuml versions prior to V1.2022.5 Description: The issue allows an attacker to bypass URL restrictions imposed by different security profiles, achieving server-side request forgery SSRF. This enables access to restricted internal...

Cross-Site Request Forgery (CSRF)

MCMS is vulnerable to cross site request forgery. The vulnerability exists due to lack of handling of parameters, allowing an attacker to bypass authentication and submit request on the behalf of the server and gain access to internal resources via the file or endpoint /role/saveOrUpdateRole.do...

Server-side Request Forgery (SSRF)

shopware/platform is vulnerable to server-side request forgery. An attacker can read or update internal resources by sending malicious requests on behalf of the server into the admin SDK functionality...

Design/Logic Flaw

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3...

CVE-2022-24871 Server-Side Request Forgery (SSRF) in Shopware

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3...

CVE-2022-24871

Shopware SSRF vulnerability (CVE-2022-24871) enables an attacker to abuse the Admin SDK on the server to read or update internal resources. Affected: Shopware platform; current fix is upgrade to 6.4.10.1. For 6.1/6.2/6.3, security measures via a plugin are available. No public workaround document...

Shopware 代码问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware that allows an attacker to abuse the Admin SDK functionality on the server to read or update internal resources...

CVE-2022-27943

A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangleconst function in ibiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a...

PT-2022-13575 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: calibre-web versions prior to 0.6.18 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository janeczku/calibre-web. SSRF is a type of attack where an attacker can trick a server into making requests to...