CVE-2024-37171

SAP Transportation Management Collaboration Portal allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that...

CVE-2024-31897

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...

PT-2024-9896 · Sap · Sap Transportation Management

Name of the Vulnerable Software and Affected Versions: SAP Transportation Management Collaboration Portal affected versions not specified Description: The issue allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application, triggering the...

PT-2024-24272 · Ibm · Ibm Cloud Pak For Business Automation

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Business Automation versions 18.0.0 through 23.0.2 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other...

WordPress plugin WP Scraper code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-27425 · Foxiz · Foxiz

Name of the Vulnerable Software and Affected Versions: Foxiz versions 2.3.5 and earlier Description: A Server-Side Request Forgery SSRF vulnerability has been identified in Theme-Ruby Foxiz. This issue allows for unauthorized access to internal resources, potentially leading to sensitive data...

PT-2024-27376 · WordPress · Wp Scraper

Name of the Vulnerable Software and Affected Versions: WP Scraper versions 5.7 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This issue allows an attacker to forge requests from the server, potentially leading to unauthorized access to internal resources...

PT-2024-22859 · Unknown · Volmarg Personal Management System

Name of the Vulnerable Software and Affected Versions: Volmarg Personal Management System version 1.4.64 Description: The Volmarg Personal Management System is vulnerable to Server Side Request Forgery SSRF via uploading a SVG file. This allows the server to make unintended HTTP and DNS requests ...

PT-2024-28626 · Fedify · Fedify

Name of the Vulnerable Software and Affected Versions: Fedify versions prior to 0.9.2, 0.10.1, or 0.11.1 Description: The issue is related to a Server Side Request Forgery attack. When Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the...

Personal Management System security breach

Personal Management System is a web application for managing personal data by Dariusz Personal Developer. A security vulnerability exists in Personal Management System version 1.4.64, which stems from the presence of a server-side request forgery SSRF vulnerability that causes the server to make...

libuv: Improper Domain Lookup that potentially leads to SSRF attacks

A server-side request forgery SSRF flaw was found in the libuv package due to how the hostnameascii variable is handled in uvgetaddrinfo and uvidnatoascii. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result, attackers may be able to access...

Vulnerabilities fixed in Apache HHTP server

Apache Software Foundation has fixed vulnerabilities in the Apache HTTP Server. A malicious party can exploit the vulnerabilities to cause a denial-of-service, manipulate traffic via Server-Side-Request-Forgery SSRF, or execute code within the Web server, which the malicious party is not initiall...

MESbook 安全漏洞

MESbook is a web-based system from MESbook Inc. connects to factory machines and converts data into information for real-time management. MESbook has a server-side request forgery vulnerability that can be exploited by an attacker to read the source code of a web file, read internal files or acce...

CVE-2023-50952

IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 275774...

Apache Santuario Security Vulnerability

Apache Santuario is a set of major security standards for implementing XML from the Apache Foundation in the U.S. It contains two libraries: Apache XML Security for Java and Apache XML Security for C++. A security vulnerability exists in Apache Santuario that stems from protection against...

CVE-2024-5014

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form...

PT-2024-33971 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A Server Side Request Forgery issue exists in the GetASPReport feature, allowing any authenticated user to retrieve ASP reports from an HTML form. Recommendations: For versions prior to...

UBUNTU-CVE-2023-45195

Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4...

PT-2024-27967

Name of the Vulnerable Software and Affected Versions cyclonedx-core-java versions prior to 9.0.4 Description The CycloneDX core module provides a model representation of SBOMs and utilities for creating, validating, and parsing them. Before deserializing CycloneDX Bill of Materials in XML format...

The vulnerability of Apache CXF web services arises from insufficient validation of user input data, allowing attackers to execute SSRF attacks.

The vulnerability of Apache CXF web services arises due to insufficient validation of data entered by users through Aegis DataBinding. Exploiting this vulnerability can allow a malicious actor to perform an SSRF attack remotely...