CVE-2024-6522

CVE-2024-6522 – Normal mode Affected software: Modern Events Calendar (WordPress) and Modern Events Calendar Lite. Root cause: Server-Side Request Forgery (SSRF) via the mec_fes_form AJAX function, affecting all versions up to 7.12.1. Impact: Authenticated attackers with Subscriber-level access a...

CVE-2024-6522 Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mecfesform' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitra...

WordPress Modern Events Calendar Lite Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Lite Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 910627b36a58 Credits Foxyy...

WordPress Modern Events Calendar Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 2c1730c6aa47 Credits Foxyyy Required...

GO-2024-3047 memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos...

GO-2024-3049 memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos...

GO-2024-3046 memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos...

Server-Side Request Forgery

@nuxt/icon is vulnerable to Server-Side Request Forgery. The vulnerability is due to improperly parsed proxied request paths in the /api/nuxticon/name endpoint, which lets an attacker change the scheme and host of the request. An attackers can exploit this flaw by passing a path prefixed with...

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

GHSA-65FM-2JGR-J7QQ memos vulnerable to Server-Side Request Forgery in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

Nuxt Icon affected by a Server-Side Request Forgery (SSRF)

Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...

CVE-2024-36448

UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...

CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)

UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...

CVE-2024-39713

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...

CVE-2024-39713

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...

CVE-2024-39713

Summary: CVE-2024-39713 affects Rocket.Chat’s Twilio webhook endpoint and enables Server-Side Request Forgery (SSRF) prior to version 6.10.1. The vulnerability allows an unauthenticated actor to induce the server to make arbitrary outbound requests to internal or external resources. Affected prod...

WonderCMS Server-Side Request Forgery Vulnerability

WonderCMS is a PHP-based open source content management system CMS from WonderCMS. A server-side request forgery vulnerability exists in WonderCMS version 3.4.3, which stems from a failure to properly validate user input in the Plugins Page, and can be exploited by an attacker to force the...

CVE-2024-39637 WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through = 9.2.0...

CVE-2024-39637

CVE-2024-39637 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WordPress theme Edubin (Pixelcurve) up to version 9.2.0. Public details consistently describe SSRF but do not provide the exact exploit vector or affected configurations beyond “Edubin: from n/a through 9.2.0.” The...