GHSA-58QW-P7QM-5RVH Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations

From the reporter XmlParser is vulnerable to XML external entity XXE vulnerability. XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit this vulnerability in order to achieve SSRF or cause a denial of service. One possible scenario is importing a remote...

CVE-2023-3238

A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The...

PT-2023-23747 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: mccms versions up to 2.6.5 Description: A critical issue has been found, affecting the pic save function of the file sys/apps/controllers/admin/Comic.php. The manipulation of the pic argument leads to server-side request forgery, which can be...

WordPress Plugin Gutenberg Blocks 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

CVE-2023-20173

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...

Cisco Identity Services Engine 代码问题漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An XML external entity injection vulnerability...

PT-2023-2778 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to the web-based management interface of Cisco Identity Services Engine ISE and involves multiple vulnerabilities. These vulnerabilities coul...

ManageEngine OpManager 代码问题漏洞

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO. It is used to manage routers, firewalls, servers, switches and printers. A code issue vulnerability exists in ManageEngine OpManager version 12.6.168, which stems from the presence of an XML External Entity XXE ...

Infoline Project Management System 代码问题漏洞

Infoline Project Management System is a project management system from Infoline. A code issue vulnerability exists in Infoline Project Management System versions prior to 4.09.31.125. An attacker could exploit this vulnerability to perform a server-side request forgery attack...

CVE-2023-20062

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery SSRF attack on an affected system. Cisco plans to release software updates that address these vulnerabilities...

SUSE CVE-2018-1000010

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

SUSE CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

Splunk 代码问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

PT-2023-16375 · Yugabyte · Yugabyte Managed

Name of the Vulnerable Software and Affected Versions: Yugabyte Managed versions 2.0.0.0 through 2.13.0.0 Description: The issue affects Yugabyte Managed, allowing accessing functionality not properly constrained by ACLs, communication channel manipulation, and authentication abuse due to...

Vulnerabilities fixed in Cisco Identity Services Engine (ISE).

Cisco has fixed vulnerabilities in Identity Services Engine ISE. A malicious person with access to the Web-based management environment could exploit the vulnerabilities to gain access to sensitive data via a Same Server Request Forgery to gain access to sensitive data. It is good practice not to...

Netcad KEOS 代码问题漏洞

Netcad KEOS is Netcad's local management solution that responds to e-municipal needs with secure, integrated data production and management capabilities. A security vulnerability exists in Netcad KEOS version 1.0 that stems from vulnerability to XML External Entity XXE attacks, which can lead to...

PT-2023-19589 · Jenkins · Jenkins Semantic Versioning Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Semantic Versioning Plugin versions 1.14 and earlier Description: The issue allows attackers who can control agent processes to have Jenkins parse a crafted file, potentially leading to the extraction of secrets from the Jenkins...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CVE-2022-39039

aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTPs request to launch Server-Side Request Forgery SSRF attack, to perform arbitrary system command or disrupt service...

Esri Portal For ArcGIS 代码问题漏洞

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A code issue vulnerability exists in Esri Portal for ArcGIS 10.9.1 and prior versions...