SSRF vulnerability in APPCMS admin\download_frame.php file

APPCMS is a professional APP content management system that provides a variety of extension modules, such as information, recommended positions, topics, friendly links, body internal links and so on, to help webmasters better personalize their own websites. An SSRF vulnerability exists in the...

thoughtbot Paperclip ruby gem server-side request forgery vulnerability

The thoughtbot Paperclip ruby gem is an open source Ruby-based file attachment manager from thoughtbot, USA. A server-side request forgery vulnerability exists in the Paperclip::UriAdapter class in the thoughtbot Paperclip ruby gem 3.1.4 and later versions. An attacker can exploit this...

File Containment Vulnerability in Youkai 365 Business v1.5 System

Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. A file inclusion vulnerability exists in the UX365 Business v1.5 system, which is due...

Server side request forgery (ssrf)

SSRF exists in Webmin 1.850 via the PATHINFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000...

CVE-2017-15644

SSRF exists in Webmin 1.850 via the PATHINFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000...

CVE-2017-15280

The CVE-2017-15280 entry applies to Umbraco CMS and describes an XML External Entity (XXE) vulnerability affecting earlier Umbraco versions (notably before 7.7.3). The underlying issue is XXE in the XML parsing path related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.as...

Umbraco CMS XML External Entity Vulnerability

Umbraco is the leading open source Microsoft ASP.NET CMS. An XML external entity vulnerability exists in Umbraco CMS, which could allow an attacker to obtain sensitive information by reading files on the server or sending TCP requests to an intranet host...

intranet.eddocs.com XSS vulnerability

Vulnerable URL: https://intranet.eddocs.com/authenticate/default.php?msg=%22%3E%3Csvg/onload=prompt%27openbugbounty%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

Multiple Vulnerabilities in LaneCat Intranet Security Management System Vulnerabilities

LaneCat is a carrier-grade Internet behavior management system launched by Xiamen Chengchuang Technology Co. LaneCat intranet security management system has denial of service and SQL injection vulnerabilities, attackers can send unlimited verification codes to cell phones to consume server...

Docutek Solutions Good for Enterprise for Android Privilege Gain Vulnerability

Docutek Solutions Good for Enterprise for Android is a mobile coworking application from Docutek Solutions for the Android platform. The program supports features such as email, calendar and contacts. A security vulnerability exists in version 3.0.0.415 of the Docutek Solutions Good for Enterpris...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Server Side Request Forgery (SSRF)

Wordpress is vulnerable to local server side request forgery SSRF attacks. The attacks are possible because the application ignores octal and hexadecimal IP address formats for intranet address, allowing attackers to escape the SSRF protection mechanism through malicious IP addresses...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Synology Chat contains a Server-Side Request Forgery (SSRF) in the link preview component that affects versions prior to 1.1.0-0806. Remote authenticated users can access intranet resources via unspecified vectors. The CNVD/NVD entries confirm the vulnerability in Synology Chat and warn about the...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

SSRF Vulnerability in Wordpress updraftplus Plugin

Wordpress updraftplus is a plugin that assists Wordpress users in backing up their websites, allowing them to back up their entire site to various clouds. An SSRF vulnerability exists in the Wordpress updraftplus plugin. The vulnerability is due to admin.php script updraftajaxhandler function uri...