CVE-2023-6805

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

CVE-2023-6805 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

CVE-2024-22354 IBM WebSphere Application Server XML external entity injection

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memo...

CVE-2024-22354

CVE-2024-22354 affects IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5. It is an XML External Entity (XXE) vulnerability when processing XML data. A remote attacker could potentially expose sensitive information, exhaust memory reso...

CVE-2024-22354 IBM WebSphere Application Server XML external entity injection

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memo...

WordPress RSS Aggregator by Feedzy Plugin <= 4.4.7 is vulnerable to Server Side Request Forgery (SSRF)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.4.7 Fixed in 4.4.8 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-6805 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b683d6b9d5c6 Credits Colin Xu...

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty XML External Entity Injection Vulnerability

IBM WebSphere Application Server WAS and IBM WebSphere Application Server Liberty are both products of International Business Machines IBM.IBM WebSphere Application Server is an application server IBM WebSphere Application Server is an application server product. The product is a platform for...

The vulnerability of the uv_getaddrinfo() function (src/unix/getaddrinfo.c, src/win/getaddrinfo.c) in the libuv library, which allows a attacker to perform an SSRF attack

The vulnerability of the uvgetaddrinfo function sources: src/unix/getaddrinfo.c, src/win/getaddrinfo.c in the library with asynchronous input/output, libuv, is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

CVE-2024-30256

Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117...

CVE-2024-30256 Open WebUI vulnerable to server-side request forgery in utils.py

Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117...

CVE-2024-30256

CVE-2024-30256 affects Open WebUI prior to version 0.1.117. The vulnerability is an authenticated blind server-side request forgery (SSRF) in the backend, specifically in the function download_file_stream() inside Open WebUI’s backend/apps/web/routers/utils.py, exploitable via the url parameter. ...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

CVE-2024-1183 SSRF Vulnerability in gradio-app/gradio

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

WordPress Really Simple SSL Plugin <= 7.2.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Really Simple SSL Type Plugin Vulnerable versions = 7.2.3 Fixed in 8.0.0 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-31229 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 76c7c2d9a771 Credits Anan...

CVE-2024-32430

Server-Side Request Forgery SSRF vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14...

CVE-2024-32430 WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14...

CVE-2024-32430

CVE-2024-32430 is a Server-Side Request Forgery (SSRF) vulnerability in the ActiveCampaign WordPress plugin (ActiveCampaign – Forms, Site Tracking, Live Chat) affecting versions up to 8.1.14. The CVSS metrics indicate a critical impact (CVSS 3.1: 9.8) with network access, no user interaction, and...

CVE-2024-32454 WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0...

CVE-2024-32454 WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0...

CVE-2024-32454

CVE-2024-32454 is an SSRF vulnerability in the WordPress plugin Appointment Bookings for Zoom, Google Meet, and related tools (Wappointment), affecting versions up to 2.6.0. It is an authenticated (Administrator+) issue that could enable server-side requests from the plugin. The Patch status indi...