Synology Download Station SSRF Vulnerability

Synology Download Station is a download management tool for Synology. A server-side request forgery vulnerability exists in the Synology Download Station task management component, which can be exploited by remote attackers to submit a special request to obtain sensitive information...

Server-Side Request Forgery (SSRF) in kalcaddle/kodexplorer

✍️ Description SSRF via SVG due to improper processing of SVG files. 🕵️‍♂️ Proof of Concept Payload: https://drive.google.com/file/d/1q-GHJ01p8Ssok1GWN-QxSznBy1JGvY8x/view?usp=sharing Download and upload it on the server and run the server on port 8000 and then view the file. 💥 Impact This...

Server-Side Request Forgery (SSRF) in kalcaddle/kodexplorer

✍️ Description SSRF protection bypass via crafted payload which leads to SSRF. 🕵️‍♂️ Proof of Concept Payload: 2130706433 This is the decimal way of representing localhost which resolves to localhost. 💥 Impact This vulnerability is capable of SSRF...

CVE-2021-34808

Server-Side Request Forgery SSRF vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors...

Exploitation of Accellion File Transfer Appliance

Summary This joint advisory is the result of a collaborative effort by the cybersecurity authorities of Australia,1 New Zealand,2 Singapore,3 the United Kingdom,4 and the United States.56 These authorities are aware of cyber actors exploiting vulnerabilities in Accellion File Transfer Appliance...

CVE-2021-20483

IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591...

Server side request forgery (ssrf)

IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591...

CKEditor 3 - Server-Side Request Forgery (SSRF)

Exploit Title: CKEditor 3 - Server-Side Request Forgery SSRF Google Dorks : inurl /editor/filemanager/connectors/uploadtest.html Date: 12-6-2021 Exploit Author: Blackangel Software Link: https://ckeditor.com/ Version:all version under 4 1,2,3 Tested on: windows 7 Steps of Exploit:- 1-using google...

CKEditor / FCKeditor 'uploadtest.html' SSRF Vulnerability

The Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms ...

CVE-2020-2305

A flaw was found in the mercurial plugin in Jenkins. The XML changelog parser is not configured to prevent an XML external entity XXE attack allowing an attacker the ability to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

Microsoft SharePoint Server 16.0.10372.20060 - (GetXmlDataFromDataSource) SSRF Exploit

Exploit Title: Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery SSRF Exploit Author: Alex Birnberg Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=57462 Version: 16.0.10372.20060 Tested on: Windows Server 2019 CVE :...

Adobe Experience Manager 6.5.0.0 < 6.5.9.0 Multiple Vulnerabilities (APSB21-39)

The version of Adobe Experience Manager installed on the remote host is prior to 6.5.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-39 advisory. - Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a...

CVE-2020-15377

Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery SSRF...

Adobe Experience Manager Server-Side Request Forgery Vulnerability

Adobe Experience Manager is an enterprise content management solution that helps you streamline the management and delivery of your content and assets. A server-side request forgery vulnerability exists in Adobe Experience Manager. An attacker could exploit this vulnerability to bypass security...

SUSE: Security Advisory (SUSE-SU-2021:0176-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM DataPower Gateway vulnerable to an RCE attack (CVE-2020-5014)

Summary IBM has addressed the relevant CVE Vulnerability Details CVEID: CVE-2020-5014 DESCRIPTION: IBM DataPower Gateway could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. CVSS Base score: 6.7 CVSS Tempor...