10162 matches found
CVE-2024-46468
A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...
CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...
CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...
CVE-2024-45317
A Server-Side Request Forgery SSRF vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address...
CVE-2024-45317
CVE-2024-45317 is an SSRF vulnerability in SonicWall SMA1000 appliances (firmware 12.4.3-02676 and earlier). The server-side application can be compelled by a remote, unauthenticated attacker to issue requests to unintended IPs. The public sources describe the issue, its impact and that SonicWall...
CVE-2024-46468
A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...
CVE-2024-46468
A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...
PYSEC-2024-215
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...
Gradio vulnerable to SSRF in the path parameter of /queue/join
Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...
GHSA-576C-3J53-R9JJ Gradio vulnerable to SSRF in the path parameter of /queue/join
Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...
CVE-2024-47167 SSRF in the path parameter of /queue/join in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...
CVE-2024-47167
CVE-2024-47167 affects Gradio (Python) and describes a Server-Side Request Forgery (SSRF) in the /queue/join endpoint via async_save_url_to_cache, allowing an attacker to cause the Gradio server to fetch HTTP requests from user-controlled URLs. This can enable targeting internal services within a...
SonicWall SSL-VPN SMA1000 and Connect Tunnel Windows Client Affected By Multiple Vulnerabilities
1 CVE-2024-45315 - SonicWALL SMA1000 Connect Tunnel Windows Client Link Following Denial-of-Service VulnerabilityThe Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard...
GHSA-G9FM-WC6H-PVGJ Magento Open Source Server-Side Request Forgery (SSRF) vulnerability
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection ...
CVE-2024-8977
CVE-2024-8977 describes a Server‑Side Request Forgery (SSRF) in GitLab EE affecting versions from 15.10 up to 17.2.9, 17.3 up to 17.3.4, and 17.4 up to 17.4.2 when the Product Analytics Dashboard is configured and enabled. The vulnerability is exploitable over the network with no user interaction...
CVE-2024-45119
CVE-2024-45119 affects Adobe Commerce (Magento) versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier, exposing a server-side request forgery (SSRF) that can lead to arbitrary file system reads. An admin-privileged, authenticated attacker can induce the application to make arbitrary HTTP r...
Server Side Request Forgery (SSRF)
phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the ability of an attacker to construct an XLSX file that links images from arbitrary paths, which allows for embedding those files as data: URLs and performing unauthorized HTTP GET requests...
PT-2024-34: Server Side Request Forgery (SSRF) in Passwork
The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...
PT-2024-6938 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 15.10 through 17.2.8 GitLab EE versions 17.3 through 17.3.4 GitLab EE versions 17.4 through 17.4.1 Description: An issue has been discovered in GitLab EE that could allow a remote attacker to perform a Server-Side Request...