WordPress RSS Aggregator by Feedzy Plugin <= 4.4.7 is vulnerable to Server Side Request Forgery (SSRF)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.4.7 Fixed in 4.4.8 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-6805 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b683d6b9d5c6 Credits Colin Xu...

The vulnerability of the uv_getaddrinfo() function (src/unix/getaddrinfo.c, src/win/getaddrinfo.c) in the libuv library, which allows a attacker to perform an SSRF attack

The vulnerability of the uvgetaddrinfo function sources: src/unix/getaddrinfo.c, src/win/getaddrinfo.c in the library with asynchronous input/output, libuv, is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty XML External Entity Injection Vulnerability

IBM WebSphere Application Server WAS and IBM WebSphere Application Server Liberty are both products of International Business Machines IBM.IBM WebSphere Application Server is an application server IBM WebSphere Application Server is an application server product. The product is a platform for...

CVE-2024-30256

Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117...

CVE-2024-30256 Open WebUI vulnerable to server-side request forgery in utils.py

Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117...

CVE-2024-30256

CVE-2024-30256 affects Open WebUI prior to version 0.1.117. The vulnerability is an authenticated blind server-side request forgery (SSRF) in the backend, specifically in the function download_file_stream() inside Open WebUI’s backend/apps/web/routers/utils.py, exploitable via the url parameter. ...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

CVE-2024-1183 SSRF Vulnerability in gradio-app/gradio

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

WordPress Really Simple SSL Plugin <= 7.2.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Really Simple SSL Type Plugin Vulnerable versions = 7.2.3 Fixed in 8.0.0 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-31229 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 76c7c2d9a771 Credits Anan...

CVE-2024-32430

Server-Side Request Forgery SSRF vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14...

CVE-2024-32430 WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14...

CVE-2024-32430

CVE-2024-32430 is a Server-Side Request Forgery (SSRF) vulnerability in the ActiveCampaign WordPress plugin (ActiveCampaign – Forms, Site Tracking, Live Chat) affecting versions up to 8.1.14. The CVSS metrics indicate a critical impact (CVSS 3.1: 9.8) with network access, no user interaction, and...

CVE-2024-32454 WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0...

CVE-2024-32454 WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0...

CVE-2024-32454

CVE-2024-32454 is an SSRF vulnerability in the WordPress plugin Appointment Bookings for Zoom, Google Meet, and related tools (Wappointment), affecting versions up to 2.6.0. It is an authenticated (Administrator+) issue that could enable server-side requests from the plugin. The Patch status indi...

PT-2024-24585 · Unknown · Wappointment

Name of the Vulnerable Software and Affected Versions: Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment versions n/a through 2.6.0 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially force the serve...

PT-2024-17278

Name of the Vulnerable Software and Affected Versions gradio-app/gradio affected versions not specified Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to scan and identify open ports within an internal network. By manipulating the file parameter in a GET request, ...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM includes components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-44270 DESCRIPTION: PostCSS could allow a remote attacker to bypass security...

Server Side Request Forgery

org.wildfly.security:wildfly-elytron-realm-token is vulnerable to Server Side Request Forgery. The vulnerability is due to JwtValidator.resolvePublicKey not performing any whitelisting or filtering on the destination URL address during the process of checking jku and sending an HTTP request...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Bamboo Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 8.2.1, 9.0.0, 9.1.0, 9.2.1, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vect...