forem 代码问题漏洞

Forem forem is a Ruby open source project for building online communities/forums from Forem. A security vulnerability exists in forem version v2022.11.11 and earlier versions, which stems from the discovery of a contained server-side request forgery SSRF vulnerability via component /articles/id. ...

PT-2023-20980 · Forem · Forem

Name of the Vulnerable Software and Affected Versions: forem versions up to v2022.11.11 Description: The issue is related to a Server-Side Request Forgery SSRF via the component "/articles/id". This allows attackers to access network resources and sensitive information via a crafted POST request...

PT-2023-20982 · Unknown · Openapi Generator

Name of the Vulnerable Software and Affected Versions: openapi-generator versions up to v6.4.0 Description: The issue is related to a Server-Side Request Forgery SSRF in the component "/api/gen/clients/language". This allows attackers to access network resources and sensitive information via a...

openapi-generator 代码问题漏洞

openapi-generator is a software application. It provides an open API interface. A security vulnerability exists in openapi-generator version v6.4.0 and earlier, which stems from the discovery of a vulnerability containing a server-side request forgery SSRF vulnerability via...

Appwrite 代码问题漏洞

Appwrite is Appwrite open source an end-to-end backend server . Used to package into a set of Docker microservices for web, mobile, native or backend applications. A security vulnerability exists in Appwrite v1.2.1 and earlier versions , which stems from the discovery of a contained server-side...

request-baskets 代码问题漏洞

request-baskets is a web service from rbaskets open source. A security vulnerability exists in request-baskets v1.2.1 and earlier versions, which stems from a discovery via component/api/baskets/name that contains a server-side request forgery SSRF vulnerability. An attacker could use this...

CVE-2023-25262

Stimulsoft GmbH Stimulsoft Designer Web 2023.1.3 is vulnerable to Server Side Request Forgery SSRF. TThe Reporting Designer Web offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather...

PT-2023-20005 · Stimulsoft · Stimulsoft Reporting Designer +1

Name of the Vulnerable Software and Affected Versions: Stimulsoft Designer Web version 2023.1.3 Description: The issue allows an attacker to perform Server Side Request Forgery SSRF attacks. The Reporting Designer Web can embed sources from external locations, and when a user chooses such a...

Apache Fineract 代码问题漏洞

Apache Fineract is an open source system for platformizing core banking systems. A reliable, robust and affordable financial services solution for entrepreneurs, financial institutions and service providers. A server-side request forgery vulnerability exists in Apache Fineract versions 1.4 throug...

PT-2023-19974 · Apache · Apache Fineract

Name of the Vulnerable Software and Affected Versions: Apache Fineract versions 1.4 through 1.8.3 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. Authorized users with limited permissions can gain access to the server and may be able to use the server for any outbound...

USN-5973-1 node-url-parse vulnerabilities

It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or to perform a server-side request forgery attack or open...

CVE-2023-1634

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

OTCMS 代码问题漏洞

OTCMS Nettie CMS is a content management system CMS for article-based websites. A security vulnerability exists in OTCMS version 6.72. An attacker could exploit this vulnerability to perform server-side request forgery attacks...

PT-2023-21902 · Jenkins · Jenkins Phabricator Differential Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Phabricator Differential Plugin versions 2.1.5 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. This allows attackers who can control coverag...

DEBIAN-CVE-2023-27586

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

UBUNTU-CVE-2023-27586

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

Kozea CairoSVG 代码问题漏洞

Kozea CairoSVG is a Python based software from the Kozea community that converts SVG files to PDF, EPS, PS and PNG files. A code issue vulnerability exists in Kozea CairoSVG versions prior to 2.7.0, which stems from the fact that Cairo can send requests to an external host when processing SVG...

The vulnerability of the NetAct network management system lies in the improper limitation of XML links to external objects. This allows attackers to gain unauthorized access to protected information or perform SSRF attacks.

The vulnerability of the NetAct network management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or perform an SSRF attack...

The vulnerability of the NetAct network management system lies in the improper restriction of XML links to external objects. This allows attackers to gain unauthorized access to protected information or perform SSRF attacks.

The vulnerability of the NetAct network management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or perform an SSRF attack...

PT-2023-21570 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta3 Description: The issue allows attackers to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using an IPv4-mapped IPv6 address. Recommendations: For versions...