CVE-2023-27161

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery SSRF via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

Security Bulletin: IBM Liberty for Java for IBM Cloud is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)

Summary There is a vulnerability in the Apache CXF library used by IBM Liberty for Java for IBM Cloud with the jaxws-2.2 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in...

GiveWP < 2.25.2 - Admin+ Server-Side Request Forgery

The plugin does not validate a parameter before making a request to it, which could allow users with a role of Administrator to perform an SSRF attack...

Debian: Security Advisory (DLA-695-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AJ-Report Server-Side Request Forgery Vulnerability

AJ-Report is a completely open source BI platform. AJ-Report version 0.9.8.6 suffers from a server-side request forgery vulnerability that can be exploited by an attacker to perform a server-side request forgery attack...

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Server side request forgery (ssrf)

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk...

Directus vulnerable to Server-Side Request Forgery On File Import

Summary Directus versions =9.22.4 is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack a...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2022-46973

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

Server side request forgery (ssrf)

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery SSRF vulnerability...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...

CVE-2023-26492 Directus vulnerable to Server-Side Request Forgery On File Import

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls by performing a DNS rebinding attack and...

CVE-2023-26492

Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to /files/import), exploitable via DNS rebinding to bypass IP deny lists and access sensitive internal data. Affected versions include Directus prior to 9.23.0 (e.g.,

U.S. Dept Of Defense: Unauthenticated Blind SSRF at https://█████ via xmlrpc.php file

An unauthenticated blind SSRF vulnerability was discovered on the xmlrpc.php file at a certain endpoint, allowing an attacker to send requests to external URLs and potentially conduct further attacks. Input validation and filtering are recommended to prevent such attacks in the future...

CVE-2022-46973

CVE-2022-46973 is an SSRF vulnerability affecting Report v0.9.8.6 in AJ-Report (open source BI platform). The linked documents confirm the issue is a Server-Side Request Forgery in version 0.9.8.6, with no explicit root-cause, affected components, exploit details, or remediation steps provided in...

WordPress Custom Login Admin Front-end CSS Plugin <= 1.4.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Custom Login Admin Front-end CSS Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.5 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 19400bb94bda Credits Dave Jong...

CVE-2023-20062 Cisco Unified Intelligence Center Vulnerabilities

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery SSRF attack on an affected system. Cisco plans to release software updates that address these vulnerabilities...

WordPress WordPress Page Builder – Qards Plugin <= 1.0.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Page Builder – Qards Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 10ad2232337b Credits Dave Jong...

WordPress WooVirtualWallet – A virtual wallet for WooCommerce Plugin <= 2.2.1 is vulnerable to Server Side Request Forgery (SSRF)

Software WooVirtualWallet – A virtual wallet for WooCommerce Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 178ac6a26da3...