CVE-2023-46265

Ivanti Avalanche includes CVE-2023-46265 (XXE vulnerability in the Smart Device Server) that can allow an unauthenticated attacker to leak data or perform a Server-Side Request Forgery (SSRF). The issue is tied to a decode/XML processing path and is listed among multiple related CVEs in the 6.4.2...

CVE-2023-46265

An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery SSRF...

WordPress GiveWP WordPress Plugin < 2.25.2 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:givewp:givewp"; if description...

CVE-2022-40312 WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1...

CVE-2022-40312

CVE-2022-40312 is a Server-Side Request Forgery (SSRF) vulnerability affecting GiveWP – Donation Plugin and Fundraising Platform for WordPress, specifically versions through 2.25.1. Root cause details are not fully enumerated in the provided documents, but Patchstack and CVE listings indicate the...

CVE-2023-6852

A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to...

Server side request forgery (ssrf)

A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2023-6852

CVE-2023-6852 affects kalcaddle KodExplorer up to 4.51.03, via an issue in the file plugins/webodf/app.php that enables server-side request forgery (SSRF) . The vulnerability allows remote exploitation; the exploit has been disclosed publicly. A patch is available: upgrade to 4.52.01 . The provid...

CVE-2023-50266

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

Server side request forgery (ssrf)

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266

Bazarr (versions up to 1.2.4) contains an SSRF in the proxy endpoint implemented in bazarr/bazarr/app/ui.py, where user-controlled protocol and URL values are passed directly to requests.get() without sanitization. This allows crafting GET requests to internal or external resources on behalf of t...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...

CVE-2023-49159 WordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...

CVE-2023-49159

CVE-2023-49159 affects the WordPress CommentLuv plugin (vulnerable up to 3.0.4). The issue is Server-Side Request Forgery (SSRF) that can cause the server to make unintended requests. Public sources (NVD, Red Hat, Patchstack, Wordfence) identify this entry and indicate there is no patched version...

CVE-2023-6570

A Server-Side Request Forgery SSRF flaw was found in kubeflow. Any user can use kubeflow as a proxy to access internal or external resources and have the response returned to the user by supplying a url to the namespace parameter in /pipeline/artifacts/get. This issue could allow an attacker to...

CVE-2023-48379

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

Server side request forgery (ssrf)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

CVE-2023-48379

CVE-2023-48379 affects Softnext Mail SQR Expert. The vulnerability arises from inadequate filtering of a specific URL parameter within a specific function, enabling an unauthenticated remote attacker to perform a Blind SSRF and infer internal network topology from URL error responses. Reported ac...