CVE-2024-38791 WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7...

Security Bulletin: Vulnerability in Node.js request affects IBM Cloud Pak System[CVE-2023-28155]

Summary Vulnerability in Node.js request affects IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2023-28155 DESCRIPTION: Node.js Request module is vulnerable to server-side request forgery, caused by a cross-protocol redirect bypass flaw. By sending a specially crafted request, an attacker...

CVE-2024-2090 Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remotecontent shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary...

CVE-2024-2090 Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remotecontent shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary...

WordPress Remote Content Shortcode Plugin <= 1.5 is vulnerable to Server Side Request Forgery (SSRF)

Software Remote Content Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2090 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 1a39ce70a128 Credits Francesco Carlucci Require...

Security Bulletin: Multiple vulnerabilities in Node.js axios affect IBM Cloud Pak System[CVE-2021-3749, CVE-2020-28168]

Summary Multiple vulnerabilities in Node.js axios affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vunerabilities. Vulnerability Details CVEID:CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

Exploit for Server-Side Request Forgery in Adobe Experience_Manager

This repository is an offensive tool for vulnerability exploitation, specifically targeting Adobe AEM Experience Manager vulnerabilities. The primary CVE ID is CVE-2018-12809. The tool is designed to exploit a SSRF Server-Side Request Forgery vulnerability in AEM, allowing an attacker to extract...

SUSE-SU-2024:2624-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2024-38475: Fixed improper escaping of output in modrewrite bsc1227268 - CVE-2024-38476: Fixed server may use exploitable/malicious backend application output to run local handlers via internal redirect bsc1227269 - CVE-2024-38477: Fixed...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-41305

WonderCMS v3.4.3 contains a Server-Side Request Forgery (SSRF) in the Plugins Page disclosed across multiple sources. The vulnerability arises from unvalidated input in the pluginThemeUrl parameter, enabling an attacker to coerce the application into making arbitrary outgoing requests. Impact det...

WordPress Edubin Theme <= 9.2.0 is vulnerable to Server Side Request Forgery (SSRF)

Software Edubin Type Theme Vulnerable versions = 9.2.0 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Server Side Request Forgery SSRF CVE CVE-2024-39637 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 8bcffc66bb53 Credits Ananda Dhakal Patchstack...

CBL Mariner 2.0 Security Update: httpd (CVE-2024-40898)

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40898 advisory. - SSRF in Apache HTTP Server on Windows with modrewrite in server/vhost context, allows to potentially leak NTM...

CVE-2024-41120

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

CVE-2024-41120

Affected software: streamlit-geospatial (a Streamlit multipage geospatial app). Technical issue: the url variable in pages/9_🔲_Vector_Data_Visualization.py accepts user input and passes it to gpd.read_file, which can trigger requests to arbitrary destinations. Impact described as blind server-sid...

CVE-2024-41118 streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.py

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 47 of pages/7📦WebMapService.py takes user input, which is passed to getlayers function, in which url is used with getwmslayer method...