9518 matches found
CVE-2020-35205
Server Side Request Forgery SSRF in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
Cockpit 234 Server-Side Request Forgery
Exploit Title: Cockpit Version 234 - Server-Side Request Forgery Unauthenticated Date: 08.01.2021 Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://cockpit-project.org/ Version: v234 Tested on: Ubuntu 18.04 !/usr/bin/python3 import argparse import requests import sys import urllib3...
Cockpit Version 234 - Server-Side Request Forgery (Unauthenticated)
Exploit Title: Cockpit Version 234 - Server-Side Request Forgery Unauthenticated Date: 08.01.2021 Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://cockpit-project.org/ Version: v234 Tested on: Ubuntu 18.04 !/usr/bin/python3 import argparse import requests import sys import urllib3...
OX App Suite / OX Documents 7.10.x XSS / SSRF
Product: OX App Suite / OX Documents Vendor: OX Software GmbH Internal reference: MWB-423 Vulnerability type: Server-Side Request Forgery CWE-918 Vulnerable version: 7.10.4 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version:...
[SECURITY] [DSA 4828-1] libxstream-java security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4828-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 07, 2021 https://www.debian.org/security/faq -...
Server-Side Request Forgery (SSRF)
plone.app.event is vulnerable to server-side request forgery SSRF. An attacker with the Manager access is able to submit requests on behalf of the server via the calendar import settings using file://...
Server side request forgery (ssrf)
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
Exploit for Server-Side Request Forgery in Sap Businessobjects_Business_Intelligence_Platform
CVE-2020-6308-mass-explo...
Server side request forgery (ssrf)
An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think it is a big real-life issue...
Exploit for Server-Side Request Forgery in Sap Businessobjects_Business_Intelligence_Platform
CVE-2020-6308 SAP POC !Follow on Twitterhttps://img.shields...
WordPress Canto Plugin Server-Side Request Forgery (CVE-2020-28976; CVE-2020-28977; CVE-2020-28978)
A sever-side request forgery vulnerability exists in WordPress Canto Plugin. The vulnerability is due to a lack of validation on the subdomain parameter in HTTP requests. Successful exploitation of this vulnerability could allow an unauthenticated attacker to make a request to any internal and...
Server Side Request Forgery (SSRF)
shopware/core and shopware/platform are vulnerable to server-side request forgery SSRF. An application using the library allows an attacker to bypass the validation of requests and allow to send requests on behalf of the server...
GHSA-8PFH-MM2G-HMC3 Authenticated Server Side Request Forgery
Impact Authenticated Server Side Request Forgery Patches We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...
Authenticated Server Side Request Forgery
Impact Authenticated Server Side Request Forgery Patches We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...
Remote Code Execution (RCE)
xstream is vulnerable to remote code execution RCE. The vulnerability exists through server-side request forgery when unmarshalling XStream objects with the java.beans.EventHandler, java.lang.ProcessBuilder, javax.imageio.ImageIO$ContainsFilter, and jdk.nashorn.internal.objects.NativeString class...
Server side request forgery (ssrf)
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery SSRF vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems...
Apache Airflow Server-Side Request Forgery Vulnerability
Apache Airflow is an open source tool for orchestrating complex computational workflows and data processing pipelines. A server-side request forgery vulnerability exists in the Chart and Query View of the old UI in Apache Airflow versions prior to 1.10.13. No details of the vulnerability are...
CVE-2020-10770
CVE-2020-10770 describes a Server-Side Request Forgery (SSRF) in OpenID Connect Issuer handling of the request_uri parameter in Keycloak before 13.0.0, allowing an attacker to cause the server to fetch an unverified URL. The vulnerability is backed by multiple sources within the connected documen...
Adobe Experience Manager Blind Server-Side Request Forgery Vulnerability
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...