CVE-2024-48874

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud...

Security Bulletin: IBM Storage Protect Server is susceptible to multiple authentication related vulnerabilities due to coreDNS (CVE-2022-2837, CVE-2022-2835, CVE-2024-0874).

Summary The IBM Storage Protect Server is susceptible to authentication-related vulnerabilities linked to coreDNS. These vulnerabilities may allow authenticated attacker to bypass security restrictions. Vulnerability Details CVEID:CVE-2022-2837 DESCRIPTION: coreDNS could allow a remote...

PT-2025-1604 · WordPress · Multiple Page Generator Plugin

Name of the Vulnerable Software and Affected Versions: Multiple Page Generator Plugin – MPG plugin for WordPress versions up to, and including, 4.0.5 Description: The issue allows authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating...

CVE-2024-13450

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for...

CVE-2024-13360

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicgtroubleshootaddvector. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to...

CVE-2024-13360

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicgtroubleshootaddvector. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to...

PT-2025-2132 · WordPress · Ai Power: Complete Ai Pack

Name of the Vulnerable Software and Affected Versions: AI Power: Complete AI Pack plugin for WordPress versions up to, and including, 1.8.96 Description: The issue allows authenticated attackers with subscriber-level access and above to make web requests to arbitrary locations originating from th...

PT-2025-1552 · Lexmark · Lexmark Devices

Name of the Vulnerable Software and Affected Versions: Lexmark devices affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability has been identified in the Web Services feature of newer Lexmark devices. This issue allows an attacker to forge requests to interna...

VMware Aria Automation SSRF (VMSA-2025-0001)

The VMware Aria Automation application running on the remote host is affected by a vulnerability as referenced in the VMSA-2025-0001 advisory. - VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with 'Organization Member' access to Aria Automation...

CVE-2025-22215

VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...

CVE-2025-22215

The CVE-2025-22215 SSRF vulnerability affects VMware Aria Automation. A malicious actor with "Organization Member" access can abuse server-side requests to enumerate internal services on the host/network. The advisory (VMSA-2025-0001) notes a CVSSv3 base score of 4.3 (Moderate) and lists fixed ve...

VMware Aria Automation 代码问题漏洞

VMware Aria Automation is a modern workflow automation platform from VMware that simplifies and automates complex data center infrastructure tasks to improve scalability and agility. A code issue vulnerability exists in VMware Aria Automation. An attacker exploiting this vulnerability could...

CVE-2024-12237 Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjggetyoutubeinfojustifiedgallerycallback function. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress Hurrakify 2.4 Server-Side Request Forgery Vulnerability

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2024-9624

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

Server Side Request Forgery (SSRF)

@lobehub/chat is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to insufficient input validation and improper handling of requests, allowing attackers to craft requests that can target internal services, even without authentication...

SUSE CVE-2024-6538

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CVE-2024-48874

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud...

CVE-2024-48874

CVE-2024-48874 affects Ruijie Reyee OS, specifically versions 2.206.x up to but not including 2.320.x. The root cause is a server-side request forgery (SSRF) in Ruijie’s proxy handling that could be leveraged to force proxy servers to perform arbitrary requests, enabling access to internal servic...

CVE-2024-48874 Ruijie Reyee OS Server-Side Request Forgery

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud...