9964 matches found
CVE-2025-27817
A flaw was found in apache-kafka. The Kafka client improperly handles configuration data for SASL/OAUTHBEARER connections, allowing an attacker to specify a crafted token endpoint URL. This allows for arbitrary file reads and server-side request forgery SSRF by a malicious client. Consequently,...
Security Bulletin: IBM Tivoli Application Dependency Discovery Manager is vulnerable to server-side request forgery attack.
Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to server-side request forgery. This vulnerability allows authenticated users can send specially crafted request CVE-2023-51441. Vulnerability Details CVEID:CVE-2023-51441 DESCRIPTION: Apache Axis is vulnerable to server-si...
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url"...
Security Bulletin: IBM Event Processing is vulnerable to Server-Side Request Forgery (SSRF) and credential leakage due to the axios package (CVE-2025-27152).
Summary IBM Event Processing is vulnerable to Server-Side Request Forgery SSRF and credential leakage due to the usage of axios package. The axios package is used in event processing to send or retrieve data via HTTP calls, enabling integration with external services or REST APIs during event...
Security Bulletin: IBM Event Streams is vulnerable to Server Side Request Forgery (SSRF) due to the axios component (CVE-2025-27152).
Summary IBM Event Streams is vulnerable to Server Side Request Forgery SSRF due to the axios component. In event streams, axios is used to make HTTP requests to the Event Streams REST Admin API, such as creating or listing Kafka topics. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axio...
CVE-2025-42988
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...
CVE-2025-42988 Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...
CVE-2025-42988 Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...
CVE-2025-42988
CVE-2025-42988 affects SAP Business Objects Business Intelligence Platform. The issue allows an unauthenticated attacker to enumerate HTTP endpoints on the internal network by crafting specific HTTP requests, enabling information disclosure that could facilitate SSRF. The provided documents descr...
PT-2025-24663 · Geoserver · Geoserver
Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.26.0 Description: The issue concerns the Coverage REST API, specifically the endpoint "/workspaces/workspaceName/coveragestores/storeName/method.format", which allows attackers to upload files with a specified UR...
CVE-2025-44043
Keyoti SearchUnit (prior to 9.0.0) is affected by two CVEs: CVE-2025-44043 (SSRF) in /SearchService.svc/GetResults and /GetLocationAndContentCategories, where an attacker can specify an SMB server as indexDirectory to cause the server to read/write configuration and log files on the attacker’s ho...
CVE-2025-44043
Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...
PT-2025-24590 · Sap · Sap Businessobjects Business Intelligence Platform
Name of the Vulnerable Software and Affected Versions: SAP Business Objects Business Intelligence Platform affected versions not specified Description: The issue allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by manipulating specific HTTP requests. This...
CVE-2025-44043
Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...
PT-2025-24706 · Fortinet · Forticlientems
Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientEMS versions 7.4.0 through 7.4.2 Fortinet FortiClientEMS versions prior to 7.2.6 Description: A server-side request forgery issue may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS...
PT-2025-24898 · Dell · Dell Wyse Management Suite
Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to 5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to...
PT-2025-24680 · Keyoti · Keyoti Searchunit
Name of the Vulnerable Software and Affected Versions: Keyoti SearchUnit versions prior to 9.0.0. Description: The issue is related to Server-Side Request Forgery SSRF in the /Keyoti SearchEngine Web Common/SearchService.svc/GetResults and /Keyoti SearchEngine Web...
CVE-2025-30997
Server-Side Request Forgery SSRF vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through = 5.0...