PT-2022-14099 · Unknown · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.0.7 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository jgraph/drawio. SSRF is a type of attack where an attacker can trick a server into making requests to interna...

Server side request forgery (ssrf)

A remote server-side request forgery ssrf vulnerability was discovered in HPE OneView versions: Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-28616

CVE-2022-28616 describes a server-side request forgery (SSRF) vulnerability in HPE OneView prior to 7.0. Affected product: HPE OneView. Root cause: unspecified in initial description, but remediation exists via a software update to resolve the vulnerability. Documents confirm a fix is provided by...

CVE-2022-24856

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856

Summary: CVE-2022-24856 affects FlyteConsole

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file e.g., archived artifacts that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery...

Server Side Request Forgery (SSRF)

PlantUML is vulnerable to server side request forgery. The vulnerability exists because the PlantUML methods are not properly validated which allows an attacker to access the internal servers and resources and perform unauthorized actions...

CVE-2022-1711 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.5...

CVE-2022-1723 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.6...

GHSA-3747-GJC9-VVG6 phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

The default configuration of phpThumb before 1.7.12 has a false value for the disabledebug option, which allows remote attackers to conduct Server-Side Request Forgery SSRF attacks via the src parameter...

GHSA-X34J-WXQ8-7VCM Umbraco CMS vulnerable to CSRF

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

Umbraco CMS vulnerable to CSRF

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

GHSA-J6MR-CM6X-H6JG OpenStack Glance Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

PT-2022-14063 · Unknown · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.0.5 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository jgraph/drawio. SSRF is a type of attack where an attacker can trick a server into making requests to interna...

Server side request forgery (ssrf)

SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses...

Server side request forgery (ssrf)

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks...

Server side request forgery (ssrf)

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information...

PT-2022-14073 · Drawio · Drawio

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 18.0.5 Description: The issue is related to a Server-Side Request Forgery SSRF in the editor's proxy via an IPv6 link-local address. This allows for SSRF to internal link-local IPv6 addresses. Recommendations: For...