Moodle 4.0.x < 4.0.5 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.18, 3.11.x prior to 3.11.11 or 4.0.x prior to 4.0.5. It is, therefore, affected by multiple vulnerabilities: - An information disclosure due to a user CSRF token being unnecessarily included in the URL during the redirection...

Moodle 3.9.x < 3.9.15 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.15, 3.11.x prior to 3.11.8 or 4.0.x prior to 4.0.2. It is, therefore, affected by multiple vulnerabilities: - A code injection through an omitted execution parameter elading to Remote Code Execution RCE for sites running...

Server-Side Request Forgery in Plone CMS

An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet...

GHSA-47P5-P3JW-W78W Server-Side Request Forgery in Plone CMS

An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet...

CVE-2022-27234

Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...

CVE-2022-27234

Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...

Server side request forgery (ssrf)

Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...

CVE-2022-27234

Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...

CVE-2022-27234

Server-side request forgery in the CVAT software maintained by IntelR before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access...

CVE-2022-27234

The connected documents confirm CVE-2022-27234 affects the Intel CVAT software prior to version 2.0.1, where an authenticated user can trigger server-side request forgery to disclose information via network access. Root cause centers on SSRF in CVAT’s handling of network requests. Affected produc...

PT-2023-12900 · Cvat · Cvat

Name of the Vulnerable Software and Affected Versions: CVAT versions prior to 2.0.1 Description: The issue allows an authenticated user to potentially enable information disclosure via network access due to server-side request forgery. Recommendations: For versions prior to 2.0.1, update to versi...

SUSE CVE-2016-3718

The 1 HTTP and 2 FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted image...

SUSE CVE-2017-7200

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

SUSE CVE-2019-15730

An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in th...

SUSE CVE-2020-13379

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network th...

SUSE CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint Server Side Request Forgery...

SUSE CVE-2022-35949

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF Server-side Request Forgery when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici =...

SUSE CVE-2022-38398

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

SUSE CVE-2022-40146

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14...

Nextcloud Server < 23.0.12, 24.x < 24.0.8 SSRF Vulnerability (GHSA-mqrx-grp7-244m)

Nextcloud Server is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...