CVE-2023-50259 Blind SSRF in /home/testslack endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

PT-2023-31513 · Medusa · Medusa

Name of the Vulnerable Software and Affected Versions: Medusa versions prior to 1.0.19 Description: Medusa is an automatic video library manager for TV shows. The issue is related to unauthenticated blind server-side request forgery SSRF. The testslack request handler in...

GHSA-Q5Q3-QM26-9JWM Authenticated Blind SSRF in automad/automad

automad up to 1.10.9 is vulnerable to an authenticated blind server-side request forgery in importUrl as the import function on the FileController.php file was not properly validating the value of the importUrl argument. This issue may allow attackers to perform a port scan against the local...

Security Bulletin: IBM Storage Fusion HCI may be vulnerable to Unauthorized requests (SSRF), Improper path traversal, via k8s.io/apimachinery, k8s.io/apiserver (CVE-2022-3172, CVE-2022-3162)

Summary Kubernetes' apimachinery and apiserver are used by IBM Storage Fusion HCI to interact with the OpenShift platform. Vulnerabilities in these libraries include the possibility of unauthorized requests server-side request forgery and improper path traversal, as described the the CVEs listed ...

Server side request forgery (ssrf)

A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can be initiated remotely. The exploit ha...

CVE-2023-7037 automad FileController.php import server-side request forgery

A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can be initiated remotely. The exploit ha...

CVE-2023-7037

The CVE-2023-7037 entry describes a SSRF flaw in automad up to version 1.10.9, triggered by manipulating the importUrl argument in FileController.php during the import function. This enables remote triggering of SSRF, with discussions of potential internal scans or abuse of local services in rela...

Path Traversal

org.apache.tiles: tiles-core is vulnerable to Path Traversal. The vulnerability is due to missing validation in the DefaultLocaleResolver.LOCALEKEY attribute set on the session while resolving XML definition files. This can lead to Server Side Request Forgery SSRF or XML External Entity Injection...

CVE-2023-6974 Server-Side Request Forgery (SSRF)

A malicious user could use this issue to access internal HTTPs servers and in the worst case ie: aws instance it could be abuse to get a remote code execution on the victim machine...

CVE-2023-46262

An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery SSRF in Ivanti Avalanche Remote Control server...

Server side request forgery (ssrf)

An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery SSRF in Ivanti Avalanche Remote Control server...

Server side request forgery (ssrf)

An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery SSRF...

CVE-2023-46265

An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery SSRF...

CVE-2023-46262

CVE-2023-46262 affects Ivanti Avalanche. Multiple connected sources confirm an unauthenticated SSRF condition in the Avalanche Remote Control server, tied to the validateAMCWSConnection pathway. The issue allows an attacker to craft a web request and access resources without authentication, with ...

CVE-2023-46262

An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery SSRF in Ivanti Avalanche Remote Control server...

CVE-2022-40312

Server-Side Request Forgery SSRF vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1...

CVE-2022-40312

Server-Side Request Forgery SSRF vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1...