PT-2019-14880

Name of the Vulnerable Software and Affected Versions Enghouse Web Chat version 6.1.300.31 Description A Server-Side Request Forgery SSRF issue allows an attacker to determine what is visible on the internal network by replacing the port number in the WebServiceLocation parameter of a POST reques...

CVE-2019-16948: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network as opposed to what general web traffic would see...

Moodle Filepicker 3.5.2 Server-Side Request Forgery

Exploit Title: Server Side Request Forgery in Moodle Filepicker Google Dork: / Date: 2019-07-25 Exploit Author: Fabian Mosch & Nick Theisinger r-tec IT Security GmbH Vendor Homepage: https://moodle.org/ Software Link: https://github.com/moodle/moodle Version: Moodle Versions 3.4, 3.3, 3.3.3, 3.2 ...

Computrols CBAS Trust Management Issue Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A trust management issue vulnerability exists in Computrols CBAS version 18.0.0 that stems from the program using default credentials and can be exploited by an attacker to scan an entire IPv4 network...

Server side request forgery (ssrf)

An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation port-scanning and to perform requests to adjacent workstations network-scanning, aka SSRF...

CVE-2019-6516

An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation port-scanning and to perform requests to adjacent workstations network-scanning, aka SSRF...

CVE-2019-6516

An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation port-scanning and to perform requests to adjacent workstations network-scanning, aka SSRF...

CVE-2019-6516

CVE-2019-6516 affects WSO2 Dashboard Server 2.0.0. It enables an SSRF flaw where an attacker can coerce the application to make requests to internal workstations (port-scanning) and to adjacent systems (network-scanning). Root cause described as server-side request forgery in the affected compone...

CVE-2019-6512

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

PT-2019-18134

Name of the Vulnerable Software and Affected Versions WSO2 Dashboard Server version 2.0.0 Description An issue allows the application to be forced into performing requests to the internal workstation, effectively allowing port-scanning, and to adjacent workstations, enabling network-scanning...

CVE-2019-6516: Server-Side Request Forgery (SSRF)

An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation port-scanning and to perform requests to adjacent workstations network-scanning, aka SSRF...

CVE-2019-6512: Server-Side Request Forgery (SSRF)

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

Schweitzer Engineering Laboratories Port Server Detection

Binary data 755351.prm...

GSA Bounty: SSRF in Search.gov via ?url= parameter

Summary: https://search.usa.gov/helpdocs endpoint is vulnerable to SSRF via url parameter. The parameter is protected but can be bypassed using LF %0A. Steps To Reproduce: 1. Login to Search.gov and click help manual. 2. The following request was vulnerable. - Request GET...

Authentication flaw

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechatgetxml in include/plugin/payment/wechat/notifyurl.php...

CVE-2019-9761

CVE-2019-9761 is an XXE vulnerability in PHPSHE 1.7. The issue arises from the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php, allowing an unauthenticated attacker to read arbitrary files or scan internal networks. CVSS details (NVD) indicate network attack vector, high imp...

MikroTik RouterOS Intermediary Vulnerability (CVE-2019-3924)

MikroTik RouterOS is prone to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions migh...

CVE-2019-3924

MikroTik RouterOS before 6.43.12 stable and 6.42.12 long-term is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for...

Design/Logic Flaw

MikroTik RouterOS before 6.43.12 stable and 6.42.12 long-term is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for...

CVE-2019-3924

MikroTik RouterOS before 6.43.12 stable and 6.42.12 long-term is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for...