CVE-2022-28997

CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery SSRF which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/...

CVE-2022-28997

CSZCMS v1.3.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability that can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/. The issue, documented in CVE-2022-28997 and reported across multiple sources (NVD, Red Hat, CVE List, etc.), in...

Server-Side Request Forgery (SSRF)

github.com/stripe/smokescreen is vulnerable to server-side request forgery. The vulnerability exists in BuildProxy and handleConnect functions in smokescreen.go due to the deny list option that smokescreen offers which allows an attacker to bypass the deny list feature...

CVE-2022-29188 Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen

Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

Jenkins Storable Configs Plugin跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Storable Configs Plugin 1.0 and...

CVE-2022-1767 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.7...

CVE-2022-1767 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.7...

Cross Site Request Forgery in Jenkins Storable Configs Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file e.g., archived artifacts that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery...

XML External Entity Reference in Jenkins Storable Configs Plugin

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller...

Aruba ClearPass Policy Manager Server-Side Request Forgery Vulnerability

Aruba ClearPass Policy Manager is an application of Aruba, Inc. that provides wireless network security access management system Aruba ClearPass Policy Manager is vulnerable to server-side request forgery, which can be exploited by remote, unauthenticated attackers to conduct server-side request...

PT-2022-14099 · Unknown · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.0.7 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository jgraph/drawio. SSRF is a type of attack where an attacker can trick a server into making requests to interna...

Oracle Linux 8 : httpd:2.4 (ELSA-2022-1915)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1915 advisory. - Resolves: 2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference or SSRF in forward proxy configurations Tenable has extracted the...

Server side request forgery (ssrf)

A remote server-side request forgery ssrf vulnerability was discovered in HPE OneView versions: Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-28616

CVE-2022-28616 describes a server-side request forgery (SSRF) vulnerability in HPE OneView prior to 7.0. Affected product: HPE OneView. Root cause: unspecified in initial description, but remediation exists via a software update to resolve the vulnerability. Documents confirm a fix is provided by...

CVE-2022-24856

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...

CVE-2022-24856

Summary: CVE-2022-24856 affects FlyteConsole

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file e.g., archived artifacts that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery...