CVE-2021-32802

CVE-2021-32802 affects Nextcloud Server where image-preview rendering calls a third-party library not suited for untrusted content, enabling issues such as SSRF, file disclosure, or potential code execution. Public details confirm Nextcloud versions 20.0.12, 21.0.4 and 22.1.0 no longer use the vu...

CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several...

Server side request forgery (ssrf)

eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote function...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

Server side request forgery (ssrf)

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

CVE-2021-39195

CVE-2021-39195 affects Misskey, an open source decentralized microblogging platform, via a Server-Side Request Forgery in the Upload from URL and remote attachment handling. The vulnerability could lead to disclosure of non-public information within the internal network. Red Hat security pages (a...

CVE-2017-18638

A flaw was found in graphite-web. The sendemail in the graphite-web/webapp/graphite/composer/views.py function is vulnerable to a Server-side request forgery SSRF. This flaw allows an attacker to use the vulnerable SSRF endpoint to have the Graphite web server request any resource. An attacker ca...

PT-2021-19941 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.12 Nextcloud Server versions prior to 21.0.4 Nextcloud Server versions prior to 22.1.0 Description: Nextcloud server is an open source, self-hosted personal cloud that supports rendering image previews...

CVE-2021-3758

bookstack is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

bookstack is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-3758 Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

bookstack is vulnerable to Server-Side Request Forgery SSRF...

Exploit for Server-Side Request Forgery in Microsoft

Exchange SSRF GetShell --- RunCommand CVE-2021–26855.exe -host 10.11.11.24 -mail [email protected] --- 效果图 - 写出webshell到服务器 - 使用菜刀连接webshell...

CVE-2021-22027

The vRealize Operations Manager API 8.x prior to 8.5 contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure...

CVE-2021-22027

The vRealize Operations Manager API 8.x prior to 8.5 contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure...

CVE-2021-22027

Summary of CVE-2021-22027 : The vRealize Operations Manager API contains a Server Side Request Forgery vulnerability in multiple endpoints that can be exploited by an unauthenticated attacker with network access to disclose information. This is associated with CVE-2021-22027 and is addressed in V...

CVE-2021-22026

The SSRF issue CVE-2021-22026 affects VMware vRealize Operations Manager API (versions 8.x before 8.5). The vulnerability allows an unauthenticated actor with network access to perform server-side requests, leading to information disclosure. VMware’s advisory (VMSA-2021-0018) details the affected...

Exploit for Improper Restriction of XML External Entity Reference in Wordpress

CVE-2021-29447 Impact Arbitrary File Disclosure: the cont...

VMware vRealize Operations Manager 7.5.x / 8.x Multiple Vulnerabilities (VMSA-2021-0018)

The version of VMware vRealize Operations vROps Manager running on the remote web server is 7.5.x prior to 7.5.0.18528913, 8.0.0 prior to 8.0.1.18442173, or 8.1.0 prior to 8.1.1.18442224 or 8.2.0 prior to 8.2.0.18439239 or 8.3.0 prior to 8.3.0.18439213 or 8.4.0 prior to 8.4.0.18456797. It is,...

VMware Issues Patches to Fix New Flaws Affecting Multiple Products

VMware on Wednesday shipped security updates to address vulnerabilities in multiple products that could be potentially exploited by an attacker to take control of an affected system. The six security weaknesses from CVE-2021-22022 through CVE-2021-22027, CVSS scores: 4.4 - 8.6 affect VMware...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal CKEditor (CVE-2021-33829)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-33829 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious...