9516 matches found
CVE-2020-7749 Server-side Request Forgery (SSRF)
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...
CVE-2020-7749
The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...
OX App Suite / OX Documents 7.10.3 XSS / Server-Side Request Forgery
Product: OX App Suite / OX Documents Vendor: OX Software GmbH Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.2, 7.10.3 Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.2-rev29, 7.10.3-rev15 Vendor notificatio...
GitHub Security Lab: Java: CWE-918 - Server Side Request Forgery (SSRF)
This bug was reported directly to GitHub Security Lab...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4365)
Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
CVE-2020-4772
An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...
Xxe
An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...
CVE-2020-4772
The CVE-2020-4772 XXE vulnerability affects IBM Cúram Social Program Management (Curam SPM) 7.0.9 and 7.0.10. The root cause is an XML External Entity Injection flaw in Curam SPM components, leading to potential exposure of sensitive data and the possibility of DoS, SSRF, or memory/resource exhau...
CVE-2020-4772
An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...
Security Bulletin: IBM InfoSphere Metadata Asset Manager is vulnerable to stored cross-site scripting and server-side request forgery.
Summary Stored cross-site scripting and server-side request forgery vulnerabilities in IBM InfoSphere Metadata Asset Manager was addressed. Vulnerability Details CVEID: CVE-2020-4702 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to stored cross-site scripting. This vulnerability...
Security Bulletin: An XML External Entity Injection (XXE) vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4772)
Summary An XML External Entity Injection XXE vulnerability may impact IBM Cúram Social Program Management. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. Vulnerability Details CVEID:...
Researchers Find Vulnerabilities in Microsoft Azure Cloud Service
As businesses are increasingly migrating to the cloud, securing the infrastructure has never been more important. Now according to the latest research, two security flaws in Microsoft's Azure App Services could have enabled a bad actor to carry out server-side request forgery SSRF attacks or...
Server-side Request Forgery (SSRF)
phantomjs-seo is vulnerable to server-side request forgery SSRF. An attacker is able to submit requests on behalf of the PhantomJS instance...
Server-Side Request Forgery (SSRF)
node-pdf-generator is vulnerable to server-side request forgery SSRF. Lack of input validation allows an attacker to submit requests on behalf of the server...
CVE-2020-7740 Server-side Request Forgery (SSRF)
This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack...
Server side request forgery (ssrf)
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
CVE-2020-7739 Server-side Request Forgery (SSRF)
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
U.S. Dept Of Defense: SSRF in login page using fetch API exposes victims IP address to attacker controled server
Note: This is similar to my last report 991163. Summary: Server Side Request Forgery Exposes Victims Ip Address to External Server and which made attacker possible to determine physical location of Victim with IP Tracing. Description: Server Side Request Forgery is the critical vulnerability...
Server side request forgery (ssrf)
Server-Side Request Forgery in Teltonika firmware TRB2R00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs...