Atlassian Jira Service Management 4.14.0 < 4.20.10 / 4.21.0 < 4.22.4 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Jira Service Management application running on the remote host is version 4.14.0 prior to version 4.20.10 or 4.21.0 prior to 4.22.4. It is, therefore, affected by multiple vulnerabilities: - A flaw which permits authenticated remote...

Atlassian Jira Service Desk < 4.13.22 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is version 4.14.0 prior to version 4.20.10 or 4.21.0 prior to 4.22.4. It is, therefore, affected by multiple vulnerabilities: - A flaw which permits authenticated remote attacker ...

Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

The plugin does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing. PoC 1. Install the Log HTTP Requests plugin to inspec...

Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

The plugin does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing. 1. Install the Log HTTP Requests plugin to inspect th...

Server side request forgery (ssrf)

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350...

CVE-2023-30444 IBM Watson Machine Learning on Cloud Pak for Data server-side request forgery

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350...

PT-2023-22695 · Ibm · Ibm Watson Machine Learning

Name of the Vulnerable Software and Affected Versions: IBM Watson Machine Learning on Cloud Pak for Data versions 4.0 through 4.5 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other...

WordPress Orbit Fox by ThemeIsle Plugin < 2.10.24 is vulnerable to Server Side Request Forgery (SSRF)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions 2.10.24 Fixed in 2.10.24 OWASP Top 10 A3: Sensitive Data Exposure Classification Server Side Request Forgery SSRF CVE CVE-2023-2287 Patch priority Medium CVSS severity Medium 5.5 Developer Claim ownership PSID b60604d1a545 Credits Al...

Exploit for Server-Side Request Forgery in Microsoft

CVE-2021-26855 This is a modified version of a POC for proxyl...

Server side request forgery (ssrf)

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

CVE-2023-2140 Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

CVE-2023-2140 Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

CVE-2023-2140

CVE-2023-2140 affects DELMIA Apriso releases 2017–2022. It is described as a Server-Side Request Forgery (SSRF) that could allow an unauthenticated attacker to make requests to arbitrary hosts from the DELMIA Apriso server. The NVD entry lists a High impact (I/H) with Network attack vector and no...

Security Bulletin: IBM InfoSphere DataStage Flow Designer is vulnerable to Server-Side Request Forgery

Summary A Server-Side Request Forgery vulnerability in IBM InfoSphere DataStage Flow Designer was addressed. Vulnerability Details CVEID:CVE-2021-29738 DESCRIPTION: IBM InfoSphere Data Flow Designer is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to sen...

Server-Side Request Forgery (SSRF)

Apache Superset is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to not sanitizing the url used to import a dataset from while using import dataset feature. This can lead to SSRF attack since an authenticated malicious actor can query internal resources on behalf of the...

The vulnerability of the SVG converter CairoSVG, related to insufficient validation of incoming requests, allows a attacker to perform an SSRF attack or cause a service failure.

The vulnerability of the CairoSVG SVG converter is related to insufficient validation of incoming requests during the processing of SVG files. Exploiting this vulnerability can allow an attacker to perform a SSRF attack or cause service failures...

Apache Superset Server-Side Request Forgery Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A server-side request forgery vulnerability exists in Apache Superset version 2.0.1 and earlier. The vulnerability stems from the product failing to properly validate user input and can be...

Server-Side Request Forgery (SSRF)

yuan1994/tpadmin is vulnerable to Server-Side Request Forgery. The vulnerability exists because the library does not properly validate the remote function in Upload.php which allows a remote attacker to cause an SSRF bypass via a crafted url...

CVE-2023-25504

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in...

Server side request forgery (ssrf)

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in...