Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to server-side request forgery (CVE-2024-22329)

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to server-side request forgery. Vulnerability Details CVEID:CVE-2024-22329 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to server-side...

CVE-2024-3684

CVE-2024-3684 describes a server-side request forgery in GitHub Enterprise Server that, when an attacker has an editor role in the Management Console, could grant admin access to the appliance during configuration of Artifacts & Logs and Migrations Storage. The vulnerability required access to th...

CVE-2024-29021

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery SSRF. This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the...

CVE-2024-2796

A server-side request forgery SSRF was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson...

CVE-2024-2796 SSRF in Akana API Platform

A server-side request forgery SSRF was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson...

CVE-2024-2796 SSRF in Akana API Platform

A server-side request forgery SSRF was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson...

CVE-2024-2796

CVE-2024-2796 describes a server-side request forgery (SSRF) in Akana API Platform versions prior to and including 2022.1.3. The issue affects Akana API Platform (and related entries reference Akana Community Manager Developer Portal) and is categorized with a high-severity CVSSv3.1 score (9.3) w...

CVE-2024-29021 SSRF into Sandbox Escape through Unsafe Default Configuration

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery SSRF. This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the...

CVE-2024-29021

Jud ge0: The SSRF-based sandbox escape (CVE-2024-29021) arises from Judge0’s default sandbox configuration and its isolate_job.rb flow, enabling an attacker with API access to achieve unsandboxed code execution as root inside the host when using vulnerable defaults. Affected component: Judge0 ope...

CVE-2024-29021 SSRF into Sandbox Escape through Unsafe Default Configuration

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery SSRF. This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the...

CVE-2024-31229 WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3...

Server-side Request Forgery (SSRF)

gradio is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of the 'file' parameter in a GET request, enabling attackers to scan and identify open ports within an internal network by observing responses for 'Location' headers or 'File not allowed' error...

Wappointment < 2.6.1 - Admin+ SSRF

Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal servic...

PT-2024-22681 · Memos · Memos

Name of the Vulnerable Software and Affected Versions: memos versions 0.13.2 through 0.16.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. It exists at the "/o/get/httpmeta" API endpoint, allowing unauthenticated users to enumerate the internal network and...

GHSA-74P6-39F2-23V3 Blind SSRF Leads to Port Scan by using Webhooks

Impact Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. Affected Versions Umbraco versions 13.0.0 - 13.1.1 Patches 13.1.1 Workarounds Disabling webhooks functionality...

Blind SSRF Leads to Port Scan by using Webhooks

Impact Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. Affected Versions Umbraco versions 13.0.0 - 13.1.1 Patches 13.1.1 Workarounds Disabling webhooks functionality...

CVE-2024-29035 Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1...

CVE-2024-29035 Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1...

CVE-2023-6805

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

CVE-2023-6805

CVE-2023-6805 affects RSS Aggregator by Feedzy (WordPress). It allows Blind SSRF via fetch_feed, enabling authenticated users withContributor+ to reach arbitrary external/internal locations and modify internal data. Fixed in 4.4.7 (contributor) and 4.4.8 (author); remediation is to upgrade to the...