14043 matches found
8x8 Bounty: connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scan
A Blind SSRF vulnerability was discovered in the 8x8 Connect application's ChatApps module, which allowed for internal port scans via the /api/v2/chats/image-check API path and the url JSON parameter. The vulnerability was resolved by retiring the entire API path...
SUSE CVE-2019-0227
A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...
CVE-2023-22936
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘searchlistener’ parameter in a search allows for a blind server-side request forgery SSRF by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within t...
Server side request forgery (ssrf)
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘searchlistener’ parameter in a search allows for a blind server-side request forgery SSRF by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within t...
CVE-2023-22936 Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘searchlistener’ parameter in a search allows for a blind server-side request forgery SSRF by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within t...
CVE-2023-22936
The CVE-2023-22936 issue affects Splunk Enterprise: versions prior to 8.1.13, 8.2.10, and 9.0.4 are vulnerable via the search_listener parameter in a search, enabling a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot observe the response unle...
CVE-2023-25162 Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery SSRF. Attackers can leverage enclosed alphanumeri...
CVE-2023-25162
Nextcloud Server versions prior to 24.0.8 and 23.0.12 (and Nextcloud Enterprise Server prior to 24.0.8 and 23.0.12) are affected by an SSRF vulnerability that can bypass IP filtering using specialized payloads to read metadata when hosted on AWS. The issue is fixed in Nextcloud Server 24.0.8, 23....
SSRF via filter bypass due to lax checking on IPs
None...
CVE-2022-45085
Server-Side Request Forgery SSRF vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01...
Nextcloud: Blind SSRF in Mail App
Vulnerability description not provided...
WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)
Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.12.6 Fixed in 5.12.7 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-23800 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID b83339aecda3 Credits Rafie Muhamm...
Shortcodes Ultimate < 5.12.7 - Subscriber+ SSRF
The plugin does not validate the url attribute of its sucsvtable shortcode before making a request to it, which could allow any authenticated users, such as subscriber to perform SSRF attacks...
CVE-2023-0574
Server-Side Request Forgery SSRF, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communicati...
CVE-2023-0574
CVE-2023-0574 affects Yugabyte Managed (versions 2.0.0.0–2.13.0.0). The issue combines Server-Side Request Forgery (SSRF) with improperly controlled modification of dynamically-determined object attributes and improper restriction of excessive authentication attempts, allowing access to functiona...
CVE-2022-45085
CVE-2022-45085 is a Server-Side Request Forgery (SSRF) vulnerability affecting Smartpower Web from Grup Arge Energy and Control Systems, with affected versions prior to 23.01.01. The issue is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, CVE listings) as SSRF in Smartpower Web, ...
CVE-2022-45085 Server-Side Request Forgery in Smartpower Web
Server-Side Request Forgery SSRF vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01...
CVE-2023-23943 Blind SSRF via server URL input in the Nextcloud Mail app
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is...
EXNESS: SSRF in graphQL query (pwapi.ex2b.com)
An SSRF vulnerability was discovered in the GraphQL query for allTicks on the pwapi.ex2b.com website. This vulnerability allowed an attacker to set the source parameter to perform arbitrary GET requests, potentially compromising internal services exposed to internal network requests...