10020 matches found
CVE-2022-21215 Airspan Networks Mimosa Server-Side Request Forgery (SSRF)
This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing...
SUSE SLES12: apache2 / apache2-devel / apache2-doc / apache2-example-pages / etc (SUSE-SU-2022:0440-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0440-1 advisory. - CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations bsc1193943 - CVE-2021-44790: Fixed a buffer overfl...
Server side request forgery (ssrf)
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...
CVE-2022-23644 Server-side request forgery in BookWyrm
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...
CVE-2022-23644 Server-side request forgery in BookWyrm
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...
CVE-2022-23644 Server-side request forgery in BookWyrm
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...
CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE
Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML. As the plugin doe...
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...
Exploit for Server-Side Request Forgery in Adminer
CVE-2021-21311 Adminer is an open-source database managem...
xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...
Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-1124)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-24568
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
Server side request forgery (ssrf)
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
Server-side Request Forgery (SSRF)
github.com/go-gitea/gitea is vulnerable to server-side request forgery. The vulnerability exists in the SignInOpenIDPost function of authopenid.go as it does not properly hide error information and logs, allowing an attacker to gain sensitive information about the local network...
Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...
GHSA-FMJ2-7WX8-QJ4V Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...
GHSA-MV26-CX23-VRFG Server-Side Request Forgery in @peertube/embed-api
@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery...
CVE-2021-45325
Server Side Request Forgery SSRF vulneraility exists in Gitea before 1.7.0 using the OpenID URL...
CVE-2021-45325
Vulnerability: CVE-2021-45325 affects Gitea prior to 1.7.0. Root cause: SSRF via the OpenID URL handling. Affected software: Gitea (Go-based Git service); versions before 1.7.0 are susceptible. Impact: server-side request forgery potentially exposing internal network information (per sources desc...