PT-2023-24811 · Plantuml +1 · Plantuml +1

Name of the Vulnerable Software and Affected Versions: plantuml versions prior to 1.2023.9 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository plantuml/plantuml. Recommendations: For versions prior to 1.2023.9, update to version 1.2023.9 or later to...

BigBlueButton 代码问题漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. BigBlueButton has a code issue vulnerability that stems from the presence of a server-side request forgery SSRF vulnerability...

DEBIAN-CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...

UBUNTU-CVE-2023-35133

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from insufficient validation of incoming requests on the server side. This allows attackers to execute SSRF attacks.

The vulnerability of the software platform for developing and managing online stores Magento Commerce is related to insufficient validation of incoming requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

PT-2023-25664 · Shibboleth +3 · Shibboleth Xmltooling-C +4

Name of the Vulnerable Software and Affected Versions: Shibboleth XMLTooling versions prior to 3.2.4 Shibboleth Service Provider versions prior to 3.4.1.3 Description: The issue allows Server-Side Request Forgery SSRF via a crafted KeyInfo element. This can be exploited by manipulating the KeyInf...

CVE-2023-24243

CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...

PT-2023-19496 · Cdata · Cdata Rsb Connect

Name of the Vulnerable Software and Affected Versions: CData RSB Connect version 22.0.8336 Description: A Server-Side Request Forgery SSRF issue was discovered. This issue allows an attacker to trick the server into making unintended requests, potentially leading to unauthorized access to sensiti...

Server-side Request Forgery (SSRF)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to make arbitrary requests,...

Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to mak...

Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to make...

CVE-2023-3235

A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function picapi of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploi...

CVE-2023-3236

A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function picsave of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit ha...

PT-2023-23762 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A critical issue has been found in OTCMS, affecting the processing of the file /admin/read.php?mudi=getSignal. The manipulation of the signalUrl argument leads to server-side request forgery. This issue...

PT-2023-23732 · Zhong Bang · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A critical issue has been found, affecting the get image base64 function of the file api/controller/v1/PublicController.php. This leads to server-side request forgery and can be launched...

mccms 代码问题漏洞

mccms diffuse city CMS is China's smoke and rain Jiangnan chshcms individual developers of a rapid site-building system. A code issue vulnerability exists in versions prior to mccms 2.6.5, which stems from incorrect manipulation of the parameter url leading to server-side request forgery...

PT-2023-23743 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: mccms versions up to 2.6.5 Description: A critical issue affects the function pic api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched...

mccms 代码问题漏洞

mccms diffuse city CMS is a rapid website building system for individual developers of China Smokey River South chshcms. A code issue vulnerability exists in versions prior to mccms 2.6.5, which stems from the fact that incorrect manipulation of the parameter pic can lead to server-side request...

Zhongbang CRMEB 代码问题漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A code issue vulnerability exists in Zhongbang CRMEB versions prior to 4.6.0. An attacker could exploit this vulnerability to conduct server-side request forgery attacks...

CVE-2023-25609

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...