CVE-2019-11565

Server Side Request Forgery SSRF exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter...

CVE-2019-11565

Server Side Request Forgery SSRF exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter...

Print My Blog <= 1.6.5 - Unauthenticated Server Side Request Forgery (SSRF)

The Print My Blog – Print, PDF, & eBook Converter WordPress Plugin WordPress plugin was affected by an Unauthenticated Server Side Request Forgery SSRF security vulnerability...

Server side request forgery (ssrf)

An XML external entity XXE vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2018-17169

An XML external entity XXE vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

GHSA-FVX3-G627-PHM2 Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled...

PT-2019-16962 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery SSRF attacks. SS...

Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...

Snapchat: Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata

Hey there, I was looking at your ads site with @daeken, we found some weird behavior in the import function of the creative app. Here are the steps: POC - Login to https://business.snapchat.com/ - Go to creative library - New Creative - Under "Topsnap Media", click on "Create" - Click on any of t...

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains an LDAP...

Server side request forgery (ssrf)

In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request...

CVE-2019-3395

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 the fixed version for 6.6.x, from version 6.7.0 before 6.8.5 the fixed version for 6.8.x, and from version 6.9.0 before 6.9.3 the fixed version for 6.9.x allows remote attackers to send arbitrary HTTP and WebD...

CVE-2019-3395

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 the fixed version for 6.6.x, from version 6.7.0 before 6.8.5 the fixed version for 6.8.x, and from version 6.9.0 before 6.9.3 the fixed version for 6.9.x allows remote attackers to send arbitrary HTTP and WebD...

Server side request forgery (ssrf)

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 the fixed version for 6.6.x, from version 6.7.0 before 6.8.5 the fixed version for 6.8.x, and from version 6.9.0 before 6.9.3 the fixed version for 6.9.x allows remote attackers to send arbitrary HTTP and WebD...

CVE-2019-3395

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 the fixed version for 6.6.x, from version 6.7.0 before 6.8.5 the fixed version for 6.8.x, and from version 6.9.0 before 6.9.3 the fixed version for 6.9.x allows remote attackers to send arbitrary HTTP and WebD...

Server-Side Request Forgery (SSRF)

moodle/moodle is vulnerable to server-side request forgery SSRF. An attacker is able to submit requests on behalf of the server via the editblog.php script that allows adding of external RSS feed resources. A malicious URL/TCP PORT can be added as an RSS feed resource which would cause the server...

50m-ctf: Several vulnerabilities lead to Remote Code Execution and Arbitraty File Read on multiple servers

Summary: - Tweeted image contained URL https://bit.do/h1therm to download an APK - APK API 35.243.186.41 is vulnerable to SQL Injection on username parameter and leaked location of server 104.196.12.98 through the devices table - Login form on 104.196.12.98 is vulnerable to timing attack on hash...

Server side request forgery (ssrf)

Moodle 3.5.x before 3.5.4 allows SSRF...

Server side request forgery (ssrf)

OX App Suite 7.8.4 and earlier allows SSRF...

PT-2019-6447 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.6 before patch 13 Zimbra Collaboration Suite versions 8.7.x before 8.7.11 patch 10 Zimbra Collaboration Suite versions 8.8.x before 8.8.10 patch 7 Zimbra Collaboration Suite versions 8.8.x before 8.8.11...