CVE-2023-6388

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

Server side request forgery (ssrf)

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

CVE-2023-6388

SuiteCRM 7.14.2 is affected by an SSRF vulnerability that allows an attacker to make arbitrary HTTP requests through the vulnerable server. Root cause: SSRF in the application; impact is the ability to trigger outbound requests via the server. Remediation: upgrade to a version that fixes the SSRF...

CVE-2023-6388 Suite CRM v7.14.2 - SSRF

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

CVE-2023-6388 Suite CRM v7.14.2 - SSRF

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

CVE-2023-6388 Suite CRM v7.14.2 - SSRF

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

PT-2024-2832 · Libuv +10 · Libuv +10

Name of the Vulnerable Software and Affected Versions: libuv versions prior to 1.48.0 Description: The issue arises due to the handling of the hostname ascii variable in the uv getaddrinfo function, which truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be...

WordPress WP RSS Aggregator Plugin <= 4.23.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WP RSS Aggregator Type Plugin Vulnerable versions = 4.23.5 Fixed in 4.23.6 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-0628 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID dd1943fc88ab Credits Colin Xu Requir...

Attacks, Vulnerabilities and Actors 29 January to 4 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of seven executed attacks, two instances of adversary activity, and six exploited...

Recent SSRF Flaw in Ivanti VPN Products Undergoes Mass Exploitation

A recently disclosed server-side request forgery SSRF vulnerability impacting Ivanti Connect Secure and Policy Secure products has come under mass exploitation. The Shadowserver Foundation said it observed exploitation attempts originating from more than 170 unique IP addresses that aim to...

TablePress < 2.2.5 - Authenticated(Author+) Server Side Request Forgery(SSRF) via _get_import_files

Description The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to and including 2.2.4 via the 'getimportfiles' function. This makes it possible for authenticated attackers, with author access and above, to make web...

Ivanti Connect Secure 9.x / 22.x SSRF (CVE-2024-21893)

Binary data ivanticsCVE-2024-21893.nbin...

Ivanti Policy Secure 9.x / 22.x SSRF (CVE-2024-21893)

Binary data ivantipsCVE-2024-21893.nbin...

Ivanti Connect Secure 9.x / 22.x SSRF-RCE Chain (CVE-2024-21893)

Binary data ivanticsssrfrceCVE-2024-21893.nbin...

Ivanti Policy Secure 9.x / 22.x SSRF-RCE Chain (CVE-2024-21893)

Binary data ivantipsssrfrceCVE-2024-21893.nbin...

CVE-2023-22817

CVE-2023-22817 describes an SSRF vulnerability in Western Digital My Cloud OS 5 (prior to 5.27.161), My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices (prior to 9.5.1-104). The issue stems from insufficient validation of incoming requests, allowing a rogue server on the local network to m...

CVE-2023-22817 Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products

Server-side request forgery SSRF vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing D...

Server Side Request Forgery (SSRF)

zmarkdown is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to improper filtering of URLs to determine if the URL is within a private network, which attacker to download private images on the local network...

Exploit for Command Injection in Ivanti Connect_Secure

Introduction 🌐 This repository contains a Python script desi...

GHSA-MF74-QQ7W-6J7V Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images

Impact A major blind SSRF has been found in remark-images-download, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network 192.168.1.0/24. A private service...