CVE-2022-40305

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form...

CVE-2022-40305

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form...

CVE-2022-40305

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form...

CVE-2022-40305

CVE-2022-40305 affects Canto Cumulus up to version 11.1.3. The issue is a Server-Side Request Forgery (SSRF) via the server parameter in the /cwc/login form, enabling internal network enumeration and potential resource overload. Exploitation details are not provided in the connected documents. Re...

Security Bulletin: IBM Aspera Faspex 4.4.1 and earlier has addressed an Apache vulnerabilitiy (CVE-2021-40438)

Summary This security bulletin addresses an Apache security vulnerabilitiy that have been remediated in IBM Aspera Faspex 4.4.2. Vulnerability Details CVEID:CVE-2021-40438 DESCRIPTION: Apache HTTP Server is vulnerable to server-side request forgery, caused by an error in modproxy. By sending a...

GHSA-HC94-9V26-GXWV Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF Server-Side Request Forgery attacks via a crafted requesturi parameter...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

Server side request forgery (ssrf)

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

CVE-2022-2633

CVE-2022-2633 affects the WordPress All-In-One Video Gallery plugin (versions up to 2.6.0). The root cause is improper handling of the dl parameter in ~/public/video.php, enabling unauthenticated arbitrary file downloads and server-side request forgery (SSRF). Impact is unauthenticated access to ...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

PT-2022-23534 · Gluu · Gluu Oxauth

Name of the Vulnerable Software and Affected Versions: Gluu Oxauth versions prior to 4.4.1 Description: The issue allows attackers to execute blind SSRF Server-Side Request Forgery attacks via a crafted request uri parameter. This enables attackers to forge requests from the server, potentially...

CVE-2022-31196

Databasir is a database metadata management platform. Databasir = 1.06 has Server-Side Request Forgery SSRF vulnerability. The SSRF is triggered by a sending a single HTTP POST request to create a databaseType. By supplying a jdbcDriverFileUrl that returns a non 200 response code, the url is...

EMC Data Protection Advisor < 19.7 Build B4 XSS (DSA-2022-107)

According to its self-reported version, the application is below version 19.7 Build B4. It is, therefore, affected by a stored cross-site scripting vulnerability. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context ...

Exploit for Server-Side Request Forgery in Jetbrains Hub

CVE-2022-25260 JetBrains Hub pre-auth semi-blind server-side r...

CVE-2022-33935

Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...

CVE-2022-33935

Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...

CVE-2022-33935

Summary: CVE-2022-33935 affects Dell EMC Data Protection Advisor versions 19.6 and earlier and is a stored cross-site scripting (XSS) vulnerability in the web data store component. An attacker could cause the browser to execute malicious HTML/JavaScript in the context of the vulnerable web applic...

Security Bulletin:IBM TRIRIGA Application Platform discloses CVE-2020-11987

Summary IBM TRIRIGA Application Platform discloses CVE-2020-11987 Vulnerability Details CVEID:CVE-2020-11987 DESCRIPTION: Apache XML Graphics Batik is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an...

Ubuntu: Security Advisory (USN-5006-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-33929

Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the...