CVE-2024-40544

PublicCMS v4.0.202302.e is affected by a Server-Side Request Forgery (SSRF) issue via the /admin/#maintenance_sysTask/edit endpoint. The CVE-2024-40544 entry and several connected sources confirm the vulnerability details and an overall high impact (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)...

CVE-2024-40543

PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery SSRF via the component /admin/ueditor?action=catchimage...

CVE-2024-40544

PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery SSRF via the component /admin/maintenancesysTask/edit...

CVE-2024-40543

CVE-2024-40543 affects PublicCMS v4.0.202302.e and is caused by a Server-Side Request Forgery (SSRF) via the /admin/ueditor?action=catchimage component. Public sources in Red Hat, OSV, NVD, CNNVD and PT-Research describe the flaw as enabling the server to forge requests. The connected documents c...

USN-6885-2: Apache HTTP Server regression

USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP/2 server. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Marc Stern discovered that the Apache HTTP Server...

SUSE-SU-2024:2405-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2024-38477: Fixed null pointer dereference in modproxy bsc1227270 - CVE-2024-39573: Fixed potential SSRF in modrewrite bsc1227271...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Crowd Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, and 5.3.0 of Crowd Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Crowd Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, and 5.3.0 of Crowd Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Crowd Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, and 5.3.0 of Crowd Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

WordPress Magical Addons For Elementor Plugin <= 1.1.41 is vulnerable to Server Side Request Forgery (SSRF)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.41 Fixed in 1.1.42 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-38730 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID fde356989d5f...

WordPress JSON Content Importer Plugin <= 1.5.6 is vulnerable to Server Side Request Forgery (SSRF)

Software JSON Content Importer Type Plugin Vulnerable versions = 1.5.6 Fixed in 1.6.0 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-38723 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID f916d2cf2c68 Credits...

WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Non-Blind Server Side Request Forgery SSRF vulnerability discovered by Dave Jong Patchstack in WordPress Plugin BerqWP versions = 1.7.5...

WordPress BerqWP Plugin <= 1.7.5 is vulnerable to Server Side Request Forgery (SSRF)

Software BerqWP Type Plugin Vulnerable versions = 1.7.5 Fixed in 1.7.6 OWASP Top 10 A3: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-37942 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 20a1b9b96001 Credits Dave Jong Patchstack Required...

MGASA-2024-0258 Updated apache packages fix security vulnerabilities

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encodin...

Updated apache packages fix security vulnerabilities

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encodin...

Server Side Request Forgery (SSRF)

Apache HTTP Server 2.4.59 is vulnerable to SSRF. The vulnerability is due to a missing validation in response headers leading to information disclosure, SSRF or local script execution via backend applications which have malicious or exploitable header...

Server Side Request Forgery (SSRF)

Directus is vulnerable to Server-Side Request Forgery SSRF. This vulnerability is caused by insecure redirects during file imports from external sources due to proper validation of the resulting URL, which can allows an attacker to send crafted requests to internal IP addresses, resulting in SSRF...

CVE-2024-37171

SAP Transportation Management Collaboration Portal allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that...

CVE-2024-37171 [CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal)

SAP Transportation Management Collaboration Portal allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that...

CVE-2024-37171

The CVE-2024-37171 entry concerns SAP Transportation Management (Collaboration Portal). A vulnerability allows a non-administrative attacker to craft a request from a vulnerable web application, causing the application handler to reach an unintended service. This can disclose information about th...