CVE-2021-0224 Junos OS: ANCPD core when hitting maximum-discovery-table-entries limit

A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber BRAS nodes in Juniper Networks Junos OS can cause the Access Node Control Protocol daemon ANCPD to crash and restart, leading to a Denial of Service DoS...

PYSEC-2021-22

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perfor...

Juniper Networks Junos OS 资源管理错误漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A resource management error vulnerability exists in Juniper Networks Junos OS, which arises from an...

CVE-2021-26072

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery SSRF vulnerability...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the...

FreeBSD : minio -- Server Side Request Forgery (8ec7d426-055d-46bc-8f5a-a9d73a5a71ab)

Minio developers report : Thanks to @phith0n from our community upon a code review, discovered an SSRF Server Side Request Forgery in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large. All users are advised to upgra...

PT-2021-14390 · Minio +1 · Minio +1

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2021-01-30T00-20-58Z Description: The issue is related to a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...

minio -- Server Side Request Forgery

Minio developers report: Thanks to @phith0n from our community upon a code review, discovered an SSRF Server Side Request Forgery in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large. All users are advised to upgrad...

CVE-2021-21009

Adobe Campaign Classic Gold Standard 10 and earlier, 20.3.1 and earlier, 20.2.3 and earlier, 20.1.3 and earlier, 19.2.3 and earlier and 19.1.7 and earlier are affected by a server-side request forgery SSRF vulnerability. Successful exploitation could allow an attacker to use the Campaign instance...

CVE-2021-21009 Server-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure

Adobe Campaign Classic Gold Standard 10 and earlier, 20.3.1 and earlier, 20.2.3 and earlier, 20.1.3 and earlier, 19.2.3 and earlier and 19.1.7 and earlier are affected by a server-side request forgery SSRF vulnerability. Successful exploitation could allow an attacker to use the Campaign instance...

Acronis: SSRF when configuring Website Backup on Acronis Cloud

Hi, I hope everything goes well. I have found a SSRF in https://mc-beta-cloud.acronis.com/ui//backup-console/resources when configuring the backup plan for a website. Summary While I was looking at the functionality of managing backups on websites, I saw that if you specify a local IP where to ge...

Debian DLA-2507-1 : libxstream-java security update

Several security vulnerabilities were discovered in XStream, a Java library to serialize objects to XML and back again. CVE-2020-26258 XStream is vulnerable to a Server-Side Forgery Request which can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data fr...

Server-Side Forgery Request can be activated unmarshalling with XStream

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15...