CVE-2023-38627

A post-authenticated server-side request forgery SSRF vulnerability in Trend Micro Apex Central 2019 lower than build 6481 could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the...

CVE-2023-38627

Trend Micro Apex Central 2019 (builds lower than 6481) is affected by a post-authenticated SSRF. An attacker who can run low-privilege code can interact with internal or local services directly. The description notes no requirement for user interaction, and CVSS data rates this as Medium with lim...

CVE-2023-38626

CVE-2023-38626 (Trend Micro Apex Central 2019, build

CVE-2023-38625

A post-authenticated server-side request forgery SSRF vulnerability in Trend Micro Apex Central 2019 lower than build 6481 could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the...

CVE-2023-38625

CVE-2023-38625 represents a post-authenticated SSRF in Trend Micro Apex Central 2019 (builds older than 6481). The vulnerability allows an attacker who has gained low-privilege code execution to interact with internal or local services directly. The files/endpoint or component implicated are not ...

CVE-2023-38624

CVE-2023-38624 describes a post-authenticated SSRF in Trend Micro Apex Central 2019 (builds lower than 6481). The vulnerability allows an attacker who can execute low-privilege code to interact with internal or local services directly. The description notes this is similar to CVE-2023-38625 throu...

CVE-2024-22203

Whoogle Search (self-hosted metasearch) is affected in versions before 0.8.4 by an SSRF flaw: the element method in app/routes.py fails to validate user-controlled src_type and element_url, forwarding them to send which performs a GET request. This allows crafting requests to internal and externa...

RUSTSEC-2024-0008 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Summary Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over outbound headers. Details Outbound trilliumhttp::HeaderValue and trilliumhttp::HeaderName can be constructed infallibly a...

RUSTSEC-2024-0009 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Summary Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over outbound headers. Details Outbound trilliumhttp::HeaderValue and trilliumhttp::HeaderName can be constructed infallibly a...

Medium: python3.11

Issue Overview: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-24329 The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing host...

Medium: python3.11

Issue Overview: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-24329 The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing host...

VulnCheck KEV: CVE-2021-33690

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to...

VulnCheck KEV: CVE-2023-50968

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which...

CVE-2022-40700

Server-Side Request Forgery SSRF vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress a...

CVE-2022-40700

Server-Side Request Forgery SSRF vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress a...

CVE-2022-40700

CVE-2022-40700 is an SSRF vulnerability reported against Montonio for WooCommerce and a range of WordPress plugins/themes. Affected versions include Montonio for WooCommerce up to 6.0.1 (patched in 6.0.2) and other listed plugins up to their indicated versions; several references confirm SSRF as ...

CVE-2023-32337

IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 255288...

Server side request forgery (ssrf)

IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 255288...

CVE-2023-32337 IBM Maximo Spatial Asset Management server-side request forgery

IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 255288...

CVE-2023-32337

CVE-2023-32337: IBM Maximo Spatial Asset Management is affected by a server-side request forgery (SSRF). IBM and Red Hat advisories confirm the vulnerability and list affected variants, including IBM Maximo Spatial Asset Management 7.6.1.0 and 7.6.1.1. The issue allows an authenticated attacker t...