10026 matches found
Chamilo LMS server-side request forgery vulnerability
Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association that supports the creation of instructional content, remote training, and online question answering. The system supports the creation of instructional content, remote training and online question...
CVE-2022-27426
CVE-2022-27426 describes a Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 . Attackers can enumerate internal networks and execute arbitrary system commands through a crafted Phar file. The NVD CVSS vectors indicate a high impact (CVSSv3.1: 8.8, HIGH; network attack, low complexity, no...
Uber: Full read SSRF in flyte-poc-us-east4.uberinternal.com
Uber summary TBD. @shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed b...
Bypass Protection For Server-side Request Forgery (SSRF)
github.com/stripe/smokescreen is vulnerable to Bypass protection for sever-side request forgery. Appending a dot to the end of user-supplied URLs, or by providing input in a different letter case allows an attacker to bypass the deny list feature of the library...
Security Bulletin: Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management
Summary Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management Vulnerability Details CVEID: CVE-2016-7051 DESCRIPTION: jackson-dataformat-xml is vulnerable to server-side request forgery, caused by a flaw in the XmlMapper. By using vectors related to a DTD, an attacker could...
GitHub Security Lab: [Python]: Add Server-side Request Forgery sinks
This bug was reported directly to GitHub Security Lab...
GitLab 10.5.x < 14.5.4, 14.6.x < 14.6.4, 14.7.x < 14.7.1 SSRF Vulnerability
GitLab is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2022-22339
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736...
CVE-2022-22339
CVE-2022-22339 concerns IBM Planning Analytics 2.0 and is a server-side request forgery (SSRF) vulnerability. An authenticated attacker could issue unauthorized requests from the affected system, enabling network enumeration or facilitating other attacks. The bulletin indicates the vulnerability ...
Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities
Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Planning Analytics Workspace 2.0.74. Vulnerability Details CVEID: CVE-2021-39047 DESCRIPTION: Some IBM products are vulnerable to cross-site scripting. This vulnerability allows users to embed...
CVE-2021-36202
CVE-2021-36202 describes a Server-Side Request Forgery (SSRF) in Johnson Controls Metasys’ MUI PDF export feature. An authenticated attacker could inject malicious code via this export path. Affected products are Metasys ADS/ADX/OAS versions prior to 10.1.5 and versions prior to 11.0.2. Mitigatio...
SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts
A server-side request forgery SSRF flaw in an API of a large financial technology fintech platform potentially could have compromised millions of bank customers, allowing attackers to defraud clients by controlling their bank accounts and funds, researchers have found. A team at Salt Security’s...
Server-Side Request Forgery (SSRF)
vyper is vulnerable to server-side request forgery SSRF. The vulnerability exists due to the lack of validations in bytestring leading to incorrect comparison results which allows an attacker to inject arbitrary code or change application logic...
Server-Side Request Forgery (SSRF)
calibreweb is vulnerable to server-side request forgery. The vulnerability exists in savecoverfromurl in helper.py because the internal end points are not properly validated which allows an attacker to access the devices running on the same network...
Server side request forgery (ssrf)
SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: Metasys Vulnerability: Server-side Request Forgery 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to inject...
PT-2022-13717 · Unknown · Livehelperchat
Name of the Vulnerable Software and Affected Versions: LiveHelperChat versions prior to 3.67 Description: The issue allows an attacker to bypass the SSRF filter on ports 80 and 433, making the application perform arbitrary requests. Recommendations: For versions prior to 3.67, update to version...
CVE-2022-0990
Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.18...