9801 matches found
CVE-2024-7743
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attac...
CVE-2024-7742
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch...
CVE-2024-7743 wanglongcn ltcms API Endpoint downloadUrl server-side request forgery
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attac...
CVE-2024-7742
The CVE-2024-7742 vulnerability affects wanglongcn ltcms 1.0.20, specifically the multiDownload function in /api/file/multiDownload. The issue arises from manipulating the file argument, leading to server-side request forgery (SSRF). It is a remote exploit, and public exploits have been disclosed...
CVE-2024-7742 wanglongcn ltcms API Endpoint multiDownload server-side request forgery
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch...
CVE-2024-7740
A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiat...
CVE-2024-7740 wanglongcn ltcms API Endpoint download server-side request forgery
A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiat...
CVE-2024-7740
CVE-2024-7740 — Wanglong LTcms 1.0.20 : A server-side request forgery (SSRF) vulnerability exists in the API Endpoint download function (/api/test/download) triggered by manipulating the url parameter. The issue is exploitable remotely, with public disclosures noted. Affected software: Wanglong L...
CVE-2024-7740 wanglongcn ltcms API Endpoint download server-side request forgery
A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiat...
CVE-2024-38109
CVE-2024-38109 – Azure Health Bot Elevation of Privilege is an authenticated SSRF vulnerability in Microsoft Azure Health Bot that can allow an attacker to elevate privileges over a network. The vulnerability is documented in Microsoft’s advisory (CVE-2024-38109) and is referenced in multiple fee...
Server-Side Request Forgery (SSRF)
Axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unexpected behavior where requests for path-relative URLs are processed as protocol-relative URLs...
Azure Health Bot Elevation of Privilege Vulnerability
An authenticated attacker can exploit an Server-Side Request Forgery SSRF vulnerability in Microsoft Azure Health Bot to elevate privileges over a network...
CVE-2024-41737 Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)
SAP CRM ABAP Insights Management allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application...
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...
Apache OFBiz < 18.12.11 Server-Side Request Forgery
Apache OFBiz versions prior to 18.12.11 suffers from a vulnerability allowing an unauthenticated attacker to perform a Server-Side Request Forgery via a specially forged request. No source data...
AI Engine Plugin for WordPress < 2.4.8 Server-Side Request Forgery
The WordPress AI Engine Plugin installed on the remote host is affected by a Server-Side Request Forgery SSRF. This detection is included in the AI and LLM category. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number...
CVE-2024-42365
Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...
CVE-2024-41570
An Unauthenticated Server-Side Request Forgery SSRF in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server...
Rocket.Chat < 6.10.1 Server-Side Request Forgery
The version of Rocket.Chat running on the remote host is prior to 6.10.1. It is, therefore, is affected by a server-side request forgery vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...