Server-Side Request Forgery (SSRF)

ssrf-agent is vulnerable to server-side request forgery SSRF. The vulnerability exists due to an insufficient validation check in 'defaultIpChecker' function which allows an attacker to inject malicious ip address...

CVE-2021-44147

An XML External Entity issue in Claris FileMaker Pro and Server including WebDirect before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks...

Xxe

An XML External Entity issue in Claris FileMaker Pro and Server including WebDirect before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks...

CVE-2021-44147

An XML External Entity issue in Claris FileMaker Pro and Server including WebDirect before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks...

CVE-2021-23718

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...

Server side request forgery (ssrf)

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...

CVE-2021-23718 Server-side Request Forgery (SSRF)

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...

CVE-2021-23718

CVE-2021-23718 concerns the npm package ssrf-agent (versions before 1.0.5). The vulnerability arises in the defaultIpChecker function, which fails to properly validate if a requested IP is private, enabling potential Server-Side Request Forgery (SSRF) via crafted URLs. Multiple connected sources ...

Concrete CMS 9.0.0 SSRF Vulnerability

Concrete CMS is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Claris FileMaker Pro 代码问题漏洞

Claris FileMaker Pro is a cross-platform relational database application from Claris USA. It integrates a database engine with a graphical user interface Gui and security features that allow users to modify the database, or tables, by dragging new elements onto layouts, screens. A security...

TYPO3 server-side request forgery vulnerability (CNVD-2022-17969)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland.TYPO3 has a server-side request forgery vulnerability prior to 1.0.6, which stems from the product's failure to properly validate user input and can be exploited by attackers to...

Server side request forgery (ssrf)

The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability...

CVE-2021-39303

The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability...

CVE-2021-43576

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins...

Server side request forgery (ssrf)

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins...

CVE-2021-43576

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2021-34798 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by a NULL pointer dereference in httpd core. By...

python-ipaddress: Improper input validation of octal strings

A flaw was found in python-ipaddress. Improper input validation of octal strings in stdlib ipaddress allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. The highest threat from this vulnerability is to...

CVE-2021-43293

Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery SSRF...

Server side request forgery (ssrf)

Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery SSRF...