The vulnerability of the implementation of the HTTP or FTP protocol in the console-based graphic editor ImageMagick allows a attacker to perform an SSRF attack.

The vulnerability of the HTTP or FTP protocol implementation of the console-based graphic editor ImageMagick is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability may allow a malicious actor, operating remotely, to carry out an SSRF attack...

WordPress 插件 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The Push Notifications plugin for WordPress...

firefly-iii Cross-site Request Forgery Vulnerability (CNVD-2022-19846)

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

CLSA-2021-1634925634 Fixed 9 CVEs in squid34

CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack - CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client -...

CLSA-2021-1634925554 Fixed CVEs in squid: CVE-2020-8517, CVE-2020-8450, CVE-2020-8449

CVE-2020-8449: fix improper HTTP request validation allowing access to resources which are prohibited by security filters - CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow - CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer and leading to...

Kindeditor 跨站请求伪造漏洞

Kindeditor is a lightweight open source web-based HTML rich text editor from the Kindeditor community.KindEdirot suffers from a cross-site request forgery vulnerability, which stems from WEB applications that do not adequately validate that requests come from trusted users. An attacker could...

The vulnerability of the mod_proxy module in the Apache HTTP Server allows a hacker to perform an SSRF attack.

The vulnerability of the modproxy module in the Apache HTTP Server is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

The vulnerability of the monitoring tool for virtual infrastructure vRealize Operations, a platform for virtualization at VMware Cloud Foundation, and the application lifecycle management software vRealize Suite Lifecycle Manager lies in insufficient validation of incoming requests, allowing attackers to disclose sensitive information.

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, the VMware Cloud Foundation virtualization platform, and the vRealize Suite Lifecycle Manager software management tool is related to insufficient checking of incoming requests. Exploiting this vulnerabili...

The vulnerability of the table_population.php file, a tool for monitoring Nagios XI Docker Wizard, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tablepopulation.php file of the Nagios XI Docker Wizard tool is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the monitoring tool for virtual infrastructure vRealize Operations, a platform for virtualization at VMware Cloud Foundation, and the application lifecycle management software vRealize Suite Lifecycle Manager lies in insufficient validation of incoming requests, allowing attackers to disclose sensitive information.

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, the VMware Cloud Foundation virtualization platform, and the vRealize Suite Lifecycle Manager software management tool is related to insufficient checking of incoming requests. Exploiting this vulnerabili...

The vulnerability of the monitoring tool for virtual infrastructure vRealize Operations, a platform for virtualization at VMware Cloud Foundation, and the application lifecycle management software vRealize Suite Lifecycle Manager lies in insufficient validation of incoming requests, allowing attackers to disclose sensitive information.

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, the VMware Cloud Foundation virtualization platform, and the vRealize Suite Lifecycle Manager software management tool is related to insufficient checking of incoming requests. Exploiting this vulnerabili...

CVE-2021-23404: Cross-Site Request Forgery (CSRF)

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

VMware vRealize Operations 代码问题漏洞

vmware VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A code issue vulnerability exists in VMware vRealize Operations that stems from the product...

CVE-2021-33193

CVE-2021-33193 describes a vulnerability in Apache HTTP Server where a crafted HTTP/2 method can bypass validation and be forwarded by mod_proxy, potentially enabling request splitting or cache poisoning. The issue affects Apache httpd versions 2.4.17 through 2.4.48. Connected advisories and noti...

Fix of CVE: CVE-2020-8450, CVE-2020-8517, CVE-2020-8449

CVE-2020-8449: fix improper HTTP request validation allowing access to resources which are prohibited by security filters - CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow - CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer and leading to...

CVE-2021-24504

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any use...

IBM Sterling Secure Proxy Server-Side Request Forgery Vulnerability

IBM Sterling Secure Proxy is an International Business Machines Corporation IBM application proxy for securing file transfers in an organization's unprotected zone DMZ. IBM Sterling Secure Proxy has a server-side request forgery vulnerability vulnerability that originates from a server that fails...

The vulnerability of the Axios application software Aurora Center, which allows a perpetrator to carry out an SSRF attack

The vulnerability of the Axios application software Autora Center relates to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the Accellion FTA security system, which stems from insufficiently validated incoming requests, allows a perpetrator to carry out a SSRF attack and gain unauthorized access to protected information.

The vulnerability of the Accellion FTA security system is related to insufficient verification of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack and gain unauthorized access to protected information through specially created POST requests...