CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266

Bazarr (versions up to 1.2.4) contains an SSRF in the proxy endpoint implemented in bazarr/bazarr/app/ui.py, where user-controlled protocol and URL values are passed directly to requests.get() without sanitization. This allows crafting GET requests to internal or external resources on behalf of t...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...

CVE-2023-49159 WordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...

CVE-2023-49159

CVE-2023-49159 affects the WordPress CommentLuv plugin (vulnerable up to 3.0.4). The issue is Server-Side Request Forgery (SSRF) that can cause the server to make unintended requests. Public sources (NVD, Red Hat, Patchstack, Wordfence) identify this entry and indicate there is no patched version...

CVE-2023-6570

A Server-Side Request Forgery SSRF flaw was found in kubeflow. Any user can use kubeflow as a proxy to access internal or external resources and have the response returned to the user by supplying a url to the namespace parameter in /pipeline/artifacts/get. This issue could allow an attacker to...

CVE-2023-48379

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

Server side request forgery (ssrf)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

CVE-2023-48379

CVE-2023-48379 affects Softnext Mail SQR Expert. The vulnerability arises from inadequate filtering of a specific URL parameter within a specific function, enabling an unauthenticated remote attacker to perform a Blind SSRF and infer internal network topology from URL error responses. Reported ac...

CVE-2023-48379 Softnext Mail SQR Expert - Blind Server-Side Request Forgey (SSRF)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

WordPress Premium Starter Templates Plugin < 3.2.5 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.127659";...

CVE-2023-6570

CVE-2023-6570 describes a Server-Side Request Forgery (SSRF) in kubeflow/kubeflow. The Red Hat entry explains that any user can cause the Kubeflow server to proxy requests via the namespace parameter in /pipeline/artifacts/get, potentially hijacking a user session by stealing the authentication c...

CVE-2023-40630

Unauthenticated LFI/SSRF in JCDashboards component for Joomla...

CVE-2023-40630 Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30

Unauthenticated LFI/SSRF in JCDashboards component for Joomla...

CVE-2023-40630 Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30

Unauthenticated LFI/SSRF in JCDashboards component for Joomla...

CVE-2023-40630

CVE-2023-40630 affects the JCDashboards component for Joomla (versions 1.0.0–1.1.30 per CVE records). It describes unauthenticated Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF). Root cause is an insecure handling in JCDashboards that permits LFI/SSRF without authentication. Im...

CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...

SSRF org.apache.xmlgraphics:batik-bridge Dependency in Jira Service Management Data Center and Server

This High severity org.apache.xmlgraphics:batik-bridge Dependency vulnerability was introduced in versions 4.20.0, 5.4.0, 5.7.0, 5.8.0, 5.9.0, 5.10.0, 5.11.0, and 5.12.0 of Jira Service Management Data Center and Server. This org.apache.xmlgraphics:batik-bridge Dependency vulnerability, with a CV...

WordPress Premium Starter Templates Plugin < 3.2.5 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:brainstormforce:startertemplatespro"; if description...