UBUNTU-CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

GHSA-QMGX-J96G-4428 SSRF vulnerability using the Aegis DataBinding in Apache CXF

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

PaperCut NG Security Vulnerability

PaperCut NG is a suite of next-generation printer control software from PaperCut Australia. A security vulnerability exists in PaperCut NG/MF that stems from the presence of a server-side request forgery SSRF vulnerability that allows an attacker to trick a server-side application into making HTT...

PT-2024-18391 · Papercut · Papercut Ng/Mf

Name of the Vulnerable Software and Affected Versions: PaperCut NG/MF affected versions not specified Description: This is a Server-Side Request Forgery SSRF vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests ...

CVE-2024-2049

Server-Side Request Forgery SSRF in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP...

PT-2024-2325 · Citrix · Citrix Sd-Wan Standard/Premium Editions

Name of the Vulnerable Software and Affected Versions: Citrix SD-WAN Standard/Premium Editions versions 11.4.0 through 11.4.4.46 Description: The issue is related to Server-Side Request Forgery SSRF and is caused by insufficient validation of requests on the server side. This allows an attacker t...

PT-2024-22332 · Drawio +1 · Drawio +1

Name of the Vulnerable Software and Affected Versions: OpenOlat versions prior to 18.1.6 OpenOlat versions prior to 18.2.2 Description: OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using...

CVE-2024-28215

nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...

PT-2024-21999 · Hcengineering · Hcengineering Huly Platform

Name of the Vulnerable Software and Affected Versions: hcengineering Huly Platform version 0.6.202 Description: The issue allows attackers to run arbitrary code via the upload of a crafted SVG file, exploiting a Server Side Request Forgery SSRF vulnerability. Recommendations: For version 0.6.202,...

PT-2024-22341 · Ngrinder · Ngrinder

Name of the Vulnerable Software and Affected Versions: nGrinder versions prior to 3.5.9 Description: The issue is related to a lack of access control, allowing an attacker to create or update webhook configuration. This could lead to information disclosure and limited Server-Side Request Forgery...

PT-2024-22342 · Ngrinder · Ngrinder

Name of the Vulnerable Software and Affected Versions: nGrinder versions prior to 3.5.9 Description: The issue is caused by a lack of access control, allowing an attacker to obtain the results of webhook requests. This could lead to information disclosure and limited Server-Side Request Forgery...

nGrinder Security Vulnerabilities

nGrinder is a stress testing platform that enables you to perform script creation, test execution, monitoring and results report generator simultaneously. A security vulnerability exists in nGrinder versions prior to 3.5.9 that stems from a lack of access control and allows an attacker to obtain...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...

CVE-2024-27564

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading...

PT-2024-21949 · Unknown · Chatgpt-Wechat-Personal

Name of the Vulnerable Software and Affected Versions: ChatGPT-wechat-personal affected versions not specified Description: A Server-Side Request Forgery SSRF issue in weixin.php of ChatGPT-wechat-personal allows attackers to force the application to make arbitrary requests. This enables attacker...

ChatGPT Code Issue Vulnerability

ChatGPT is a visual interface site based on the OpenAI ChatGPT project API. A code issue vulnerability exists in ChatGPT version f9f4bbc, which stems from the presence of a Server Request Forgery SSRF vulnerability. An attacker could use this vulnerability to force an application to perform...

WonderCMS Security Breach

WonderCMS is an open source PHP-based content management system CMS. A security vulnerability exists in WonderCMS v3.1.3, which stems from a Server Request Forgery SSRF vulnerability in the getFileFromRepo function. An attacker can exploit this vulnerability by injecting a specially crafted URL...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

IBM QRadar WinCollect Agent 资源管理错误漏洞

IBM QRadar WinCollect Agent is an agent program from International Business Machines IBM for collecting and sending Windows event logs. A resource management error vulnerability exists in IBM QRadar WinCollect Agent that stems from vulnerability to server-side request forgery attacks. No detailed...

PYSEC-2024-278

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...