CVE-2025-0292

SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services...

CVE-2025-0292

CVE-2025-0292 affects Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS). A Server-Side Request Forgery (SSRF) flaw allows a remote authenticated attacker with admin rights to access internal network services. Affected versions are ICS prior to 22.7R2.8 and IPS prior to 22.7R1.5. Mitigati...

CVE-2025-0292

SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services...

CVE-2025-0292

SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services...

CVE-2025-42965 Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application

SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitati...

SUSE-SU-2025:02241-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2024-38477: Fixed null pointer dereference in modproxy bsc1227270. - CVE-2024-39573: Fixed source code disclosure with handlers configured via AddType bsc1227271. - CVE-2024-39884: Fixed source code disclosure of local content bsc1227353. ...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...

CVE-2025-28963 WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7...

eKuiper /config/uploads API arbitrary file writing may lead to RCE

Summary eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys...

GHSA-GJ54-GWJ9-X2C6 eKuiper /config/uploads API arbitrary file writing may lead to RCE

Summary eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 1.0.298 Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache...

PT-2025-29376 · Go · Github.Com/Lf-Edge/Ekuiper +1

Summary eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys...

HPESBNW04886 rev.1 - HPE Telco Service Orchestrator Software, Server-Side Request Forgery (SSRF) Vulnerability

Potential Security Impact: Remote: Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-27817 |...

PT-2025-27531 · Zrlog · Zrlog

Name of the Vulnerable Software and Affected Versions: zrlog version 3.1.5 Description: A Server-Side Request Forgery SSRF issue was discovered in zrlog via the downloadUrl parameter. This allows for potential unauthorized access to internal resources. Recommendations: For zrlog version 3.1.5, as...

ROS-20250630-03

A vulnerability in the Symfony web application development and management software platform exists due to failure to take measures to neutralize special elements. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code A vulnerability in the Symfony w...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

PT-2025-27373 · Undefined · Undefined

🚨 Fedora 41 just dropped a critical Moodle security update! ✅ Fixes SSRF, IDOR, and password caching flaws CVE-2025-49513 to CVE-2025-49518. Read more: 👉 https://t.co/Nl2zuUwoVS LinuxSecurity EdTech https://t.co/CACOiVyRhw...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

MobSF vulnerability allows SSRF due to the allow_redirects=True parameter

Summary The fix for the "SSRF Vulnerability on assetlinkscheckactname, wellknowns" vulnerability could potentially be bypassed. Details Since the requests.get request in the checkurl method is specified as allowredirects=True, if "https://mydomain.com/.well-known/assetlinks.json" returns a 302...