9521 matches found
Exploit for Server-Side Request Forgery in Microsoft
MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork:...
Patch now! Exchange servers attacked by Hafnium zero-days
Microsoft has detected multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft attributes the attacks to a group they have dubbed Hafnium. “HAFNIUM primarily targets entities in the United States across a number ...
OwnCloud Code Issues Vulnerabilities
Owncloud OwnCloud is a suite of personal cloud storage solutions from OwnCloud USA. A code issue vulnerability exists in OwnCloud that stems from a server-side request forgery vulnerability in the service. No detailed vulnerability details are available at this time...
Debian DLA-2580-1 : adminer security update
Adminer is an open source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. For Debian 9 stretch, this problem has been fixed ...
[SECURITY] [DLA 2580-1] adminer security update
----------------------------------------------------------------------- Debian LTS Advisory DLA-2580-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 03, 2021 https://wiki.debian.org/LTS -...
PT-2021-2214
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An issue in Microsoft Exchange Server allows remote attackers to execute arbitrary code. The flaw is caused by insufficient validation of incoming requests, enabling a...
PrestaShop server-side request forgery vulnerability
Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features . A security vulnerability exists in PrestaShop versions prior to 1.7.2. The...
The vulnerability of the Nokogiri library lies in the improper limitation of XML links to external objects, which allows attackers to perform SSRF attacks or XXE attacks.
The vulnerability of the Nokogiri library is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack or an XXE attack...
GHSA-XR9H-9M79-X29G SSRF in Rendertron
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery SSRF attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are t...
CVE-2020-11988
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users...
Server Side Request Forgery (SSRF)
github.com/thecodingmachine/gotenberg is vulnerable to Server Side Request Forgery SSRF. An attacker is able to send malicious requests on behalf of the application via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...
Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)
The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...
Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)
The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...
Server side request forgery (ssrf)
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...
CVE-2021-23345 Server-side Request Forgery (SSRF)
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...
CVE-2021-23345
CVE-2021-23345 affects the Go package github.com/thecodingmachine/gotenberg (and related Chromium module) with a Server-Side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute references an internal file (e.g., ). Connected sources confirm this SSRF behavior and provide ...
Apache Batik Server-Side Request Forgery Vulnerability
Apache Batik is Apach open source a system library . Provides scalable vector graphics SVG format images for various purposes applications or applets. Apache Batik version 1.13 suffers from a server-side request forgery vulnerability, which is caused by a failure of NodePanel to properly validate...
Apache XmlGraphics Commons Server-Side Request Forgery Vulnerability
Apache XmlGraphics Commons is Apach open source a system library . Provides several reusable libraries. Apache XmlGraphics Commons 2.4 suffers from a server-side request forgery vulnerability that stems from the failure of XMPParser to properly validate inputs, which can be exploited by an attack...
