Server side request forgery (ssrf)

google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set ...

Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery

Description The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2023-27451

Server-Side Request Forgery SSRF vulnerability in Darren Cooney Instant Images plugin = 5.1.0.2 versions...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Darren Cooney Instant Images plugin = 5.1.0.2 versions...

CVE-2023-27451 WordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Darren Cooney Instant Images plugin = 5.1.0.2 versions...

CVE-2023-27451

CVE-2023-27451: SSRF in WordPress Instant Images plugin

Server side request forgery (ssrf)

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request...

Atlassian Confluence 7.13.x / 7.19.x < 7.19.16 (CONFSERVER-93178)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-93178 advisory. - Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue...

Server side request forgery (ssrf)

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...

CVE-2023-48307 Nextcloud Mail app vulnerable to Server-Side Request Forgery

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...

CVE-2023-6199

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF...

Server side request forgery (ssrf)

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF...

Cookies are sent to external images in rendered diff (and server side request forgery)

Impact The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that...

GHSA-7RFG-6273-F5WP Cookies are sent to external images in rendered diff (and server side request forgery)

Impact The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that...

Server side request forgery (ssrf)

XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other...

CVE-2023-48240

XWiki Platform contains a vulnerability where the rendered diff feature downloads images from any domain and forwards the user’s cookies, enabling cookie theft and server-side request forgery (SSRF). Affected versions are before 14.10.15, 15.5.1 and 15.6. The issue stems from the diff rendering p...

CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery

XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other...

CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery

XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other...

CVE-2023-32245 WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF)

Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n/a through 5.4.8...

Security Bulletin: IBM TRIRIGA Application Platform discloses server-side request forgery (CVE-2020-11988)

Summary CV-2020-11988 Apache XML Graphis Commons is vulerable to server-side request forgery. Vulnerability Details CVEID: CVE-2020-11988 DESCRIPTION: Apache XML Graphics Commons is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a...