10311 matches found
CVE-2023-6849 kalcaddle kodbox app.php cover server-side request forgery
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit...
Server side request forgery (ssrf)
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50266
Bazarr (versions up to 1.2.4) contains an SSRF in the proxy endpoint implemented in bazarr/bazarr/app/ui.py, where user-controlled protocol and URL values are passed directly to requests.get() without sanitization. This allows crafting GET requests to internal or external resources on behalf of t...
Security Bulletin: IBM Storage Protect Server is vulnerable to various attacks due to Eclipse Jetty (CVE-2023-40167, CVE-2023-41900, CVE-2023-36479, CVE-2023-36478)
Summary Eclipse Jetty is used by the IBM Storage Protect Server and may be vulnerable to these attacks. Vulnerability Details CVEID:CVE-2023-40167 DESCRIPTION: Jetty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP/1 request header. By sending a specially crafted...
CVE-2023-49159
Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...
CVE-2023-49159 WordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...
Server side request forgery (ssrf)
Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...
CVE-2023-44286
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a...
Cross site scripting
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a...
CVE-2023-44286
Dell PowerProtect DD is affected by a DOM-based Cross-Site Scripting vulnerability (CVE-2023-44286) in multiple versions: pre-7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, and 6.2.1.110. The root cause is a DOM-based XSS that allows a remote unauthenticated attacker to inject malicious HTML/JavaScript ...
CVE-2023-6570
Server-Side Request Forgery SSRF in kubeflow/kubeflow...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF in kubeflow/kubeflow...
CVE-2023-6570 Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
Server-Side Request Forgery SSRF in kubeflow/kubeflow...
CVE-2023-6570 Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
Server-Side Request Forgery SSRF in kubeflow/kubeflow...
CVE-2023-40630
Unauthenticated LFI/SSRF in JCDashboards component for Joomla...
Server side request forgery (ssrf)
Unauthenticated LFI/SSRF in JCDashboards component for Joomla...
CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...
WordPress Starter Templates Plugin < 3.2.5 SSRF Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:brainstormforce:startertemplates"; if description...
