CVE-2018-1999026

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host...

CVE-2018-1999039

The CVE-2018-1999039 entry describes a Server-Side Request Forgery (SSRF) in Jenkins Confluence Publisher Plugin (v2.0.1 and earlier) affecting the ConfluenceSite.java component. The issue allows an attacker to cause Jenkins to submit login requests to a Confluence server URL of the attacker’s ch...

Responsive Filemanager 9.13.1 - Server-Side Request Forgery

Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery Date: 2018-07-29 Exploit Author: GUIA BRAHIM FOUAD Vendor Homepage: http://responsivefilemanager.com/ Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsivefilemanager.zip...

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

idreamsoft iCMS Server-Side Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A server-side request forgery vulnerability exists in idreamsoft iCMS version 7.0.9. An attacker can exploit the vulnerability to read sensitive files and access the intranet...

Server side request forgery (ssrf)

Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2018-5006

CVE-2018-5006 is a Server-Side Request Forgery vulnerability in Adobe Experience Manager (AEM) affecting version 6.4 and earlier. The issue allows an unauthenticated or remote attacker to trigger crafted HTTP requests from the vulnerable server, potentially leading to disclosure of sensitive info...

CVE-2018-5004

CVE-2018-5004 is an SSRF vulnerability in Adobe Experience Manager versions 6.2 and 6.3. Exploitation could disclose sensitive information; user interaction is not required and the attack is network-based. Remediation is available via Adobe APSB18-23 security update for AEM to fix the SSRF issues.

CVE-2018-0398

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack. Cisco Bug IDs: CSCvg71018...

Server side request forgery (ssrf)

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack. Cisco Bug IDs: CSCvg71018...

CVE-2018-0398

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack. Cisco Bug IDs: CSCvg71018...

U.S. Dept Of Defense: Server-Side Request Forgery (SSRF)

Hi, I've found a Server-Side Request Forgery SSRF Steps to reproduce: + start listening on your server + navigate to http://██████/help/ACPS.htmhttp://$yourserver:$port + you will get the request ██████ Impact Server-Side Request Forgery SSRF Attack...

Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection Vulnerability

Exploit for java platform in category web applications Details ================ Software: Fortify SSC Software Security Center Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-12463 CVE: CVE-2018-12463 at...

Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection

Details ================ Software: Fortify SSC Software Security Center Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-12463 CVE: CVE-2018-12463 at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12463 CVSS: HIGH...

Server side request forgery (ssrf)

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided...

Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.

Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...

Server side request forgery (ssrf)

In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...

Server Side Request Forgery (SSRF)

concrete5 is susceptible to server side request forgery SSRF. The vulnerability is possible because of file replacing function in tools/files/importers/remote.php which allows to scan local network and to enumerate open TCP ports...

CVE-2018-13790

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

Debian: Security Advisory (DLA-1415-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...