CVE-2023-3015

The CVE-2023-3015 entry affects yiwent Vip Video Analysis 1.0, with a vulnerability in the data/title.php file where manipulating the titurl argument triggers server-side request forgery (SSRF). It can be exploited remotely, and public disclosures exist (VDB-230359). Connected sources corroborate...

Pydio Cells 4.1.2 - Server-Side Request Forgery Vulnerability

Exploit Title: Pydio Cells 4.1.2 - Server-Side Request Forgery Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Server-Side Request Forgery Security Risk: medium Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...

Pydio Cells 4.1.2 - Server-Side Request Forgery

Exploit Title: Pydio Cells 4.1.2 - Server-Side Request Forgery Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Server-Side Request Forgery Security Risk: medium Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...

CVE-2023-2287

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

CVE-2023-1938

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

Server side request forgery (ssrf)

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

CVE-2023-2287 Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

CVE-2023-2287

The vulnerability CVE-2023-2287 affects the Orbit Fox by ThemeIsle WordPress plugin prior to version 2.10.24. Root cause: the stock photo import feature does not restrict target URLs, enabling potential server-side requests (SSRF) to arbitrary URLs. Impact described in sources as SSRF; no exploit...

CVE-2023-1938 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

CVE-2023-1938 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Download Monitor Type Plugin Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-31219 Patch priority Low CVSS severity Low 4.1 Developer WPChill PSID fb7b8d305714 Credits Mika Required privilege Administrator...

CVE-2023-2927

The CVE-2023-2927 issue affects JIZHICMS 2.4.5, exposing the index function in TemplateController.php. The underlying vulnerability arises from manipulating the webapi argument, enabling server-side request forgery (SSRF) with remote attack capability. Public exploitation information exists (VDB-...

CVE-2023-33184

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

CVE-2023-33184 Blind SSRF in the Nextcloud Mail app on avatar endpoint

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

CVE-2023-33184 Blind SSRF in the Nextcloud Mail app on avatar endpoint

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

CVE-2023-33184

CVE-2023-33184 affects the Nextcloud Mail app in Nextcloud. A blind SSRF on the avatar endpoint could cause the app to send GET requests to internal services on the same web server. The available references indicate fixes are in Nextcloud Mail updates: v3.02, v2.2.5, or v1.15.3. There is no docum...

CVE-2023-33184 Blind SSRF in the Nextcloud Mail app on avatar endpoint

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

Blind SSRF in the Mail app on avatar endpoint

None...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2022-3172)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that can cause clients to be redirected by an aggregated API server SSRF CVE-2022-3172 Vulnerability Details CVEID: CVE-2022-3172 Description: Kubernetes kube-apiserver is vulnerable to...

Cisco Identity Services Engine XML External Entity Injection Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An XML external entity injection vulnerability...