CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE

Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML. As the plugin doe...

Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-1124)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-24568

Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...

Server side request forgery (ssrf)

Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...

Server-side Request Forgery (SSRF)

github.com/go-gitea/gitea is vulnerable to server-side request forgery. The vulnerability exists in the SignInOpenIDPost function of authopenid.go as it does not properly hide error information and logs, allowing an attacker to gain sensitive information about the local network...

Server-side request forgery (SSRF) in Apache XmlGraphics Commons

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

GHSA-FMJ2-7WX8-QJ4V Server-side request forgery (SSRF) in Apache XmlGraphics Commons

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

GHSA-MV26-CX23-VRFG Server-Side Request Forgery in @peertube/embed-api

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery...

CVE-2021-45325

Server Side Request Forgery SSRF vulneraility exists in Gitea before 1.7.0 using the OpenID URL...

CVE-2021-45325

Vulnerability: CVE-2021-45325 affects Gitea prior to 1.7.0. Root cause: SSRF via the OpenID URL handling. Affected software: Gitea (Go-based Git service); versions before 1.7.0 are susceptible. Impact: server-side request forgery potentially exposing internal network information (per sources desc...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832...

GHSA-WP47-9R3H-XFGQ Server-Side Request Forgery in Apache Traffic Control

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Server-Side Request Forgery in Apache Traffic Control

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-24129

The vulnerability CVE-2022-24129 affects the Shibboleth Identity Provider OIDC OP plugin before version 3.0.4. Root cause: insufficient restriction of the request_uri parameter enables server-side request forgery (SSRF), allowing interaction with arbitrary third-party HTTP services. Impact is SSR...