Apache Batik 代码问题漏洞

Apache Batik is Apach open source a system library . Provides scalable vector graphics SVG format images for various purposes applications or applets. Apache Batik version 1.13 suffers from a server-side request forgery vulnerability, which is caused by a failure of NodePanel to properly validate...

CVE-2020-8902

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery SSRF attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are t...

Owncloud 代码问题漏洞

Owncloud OwnCloud is a suite of personal cloud storage solutions from OwnCloud USA. A code issue vulnerability exists in OwnCloud that stems from a server-side request forgery vulnerability in the service. No detailed vulnerability details are available at this time...

UBUNTU-CVE-2020-28463

All versions of package reportlab are vulnerable to Server-side Request Forgery SSRF via img tags. In order to reduce risk, use trustedSchemes & trustedHosts see in Reportlab's documentation Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ...

PYSEC-2021-146

All versions of package reportlab are vulnerable to Server-side Request Forgery SSRF via img tags. In order to reduce risk, use trustedSchemes & trustedHosts see in Reportlab's documentation Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ...

ReportLab 代码问题漏洞

ReportLab is a Danish ReportLab company for the creation of data-driven PDF documents and custom vector graphics open source engine . A security vulnerability exists in Reportlab. The vulnerability stems from a server-side request forgery vulnerability that can be triggered by img tags. Currently...

Accellion FTA 代码问题漏洞

Accellion File Transfer Appliance FTA is a secure file transfer service that allows users to share and synchronize files online, all encrypted with AES 128/256. A server-side request forgery vulnerability exists in Accellion FTA 912411 and earlier versions. An attacker can exploit this...

Server-side Request Forgery (SSRF)

Overview github.com/pterodactyl/wings/router/downloader is a Wings is Pterodactyl's server control plane, built for the rapidly changing gaming industry and designed to be highly performant and secure. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. It is...

DEBIAN-CVE-2021-21311

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. This is fixed in version 4.7.9...

UBUNTU-CVE-2021-21311

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. This is fixed in version 4.7.9...

CVE-2021-21311 SSRF in adminer

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. This is fixed in version 4.7.9...

PT-2021-14409

Name of the Vulnerable Software and Affected Versions: Adminer versions 4.0.0 through 4.7.9 Description: Adminer is an open-source database management in a single PHP file. There is a server-side request forgery vulnerability in Adminer versions bundling all drivers, such as adminer.php. This iss...

Server-Side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF via the download feature. This allows attackers to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform...

DEBIAN-CVE-2021-21288

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...

The vulnerability of the session verification function of the Cisco Data Center Network Manager (DCNM) allows a attacker to perform an SSRF attack.

The vulnerability of the session verification function in Cisco Data Center Network Manager DCNM is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to perform an SSRF attack remotely...

CVE-2021-25241

A server-side request forgery SSRF information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep...

OESA-2021-1015 xstream security update

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for...

Trend Micro OfficeScan XG 和 Trend Micro Worry-Free Business Security 代码问题漏洞

Trend Micro OfficeScan XG and Trend Micro Worry-Free Business Security are both products of Trend Micro, Inc.Trend Micro OfficeScan XG is a distributed anti-virus software.Trend Micro Worry-Free Business Security is an enterprise-class information security solution. Worry-Free Business Security i...

Trend Micro Apex One和Trend Micro Worry-Free Business Security 代码问题漏洞

Trend Micro Apex One and Trend Micro Worry-Free Business Security are both products of Trend Micro, Inc.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response.Trend Micro Worry-Free Business Security is an enterprise-class information...

jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks

A flaw was found in the subversion Jenkins plugin. The XML parser is not properly configured to prevent XML external entity XXE attacks allowing an attacker the ability to control an agent process and have Jenkins parse a crafted changelog file that uses external entities for extraction of secret...