Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly...

Server side request forgery (ssrf)

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

Lexmark Printer SSRF Vulnerability (Jan 2023)

Multiple Lexmark printer devices are prone to a server-side request forgery SSRF vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2023-24495

The CVE-2023-24495 SSRF issue in Tenable.sc arises from improper validation of session and user-accessible input data, enabling a privileged, authenticated attacker to interact with external and internal services. Public sources in the connected documents confirm that Tenable.sc prior to version ...

CVE-2022-46998

CVE-2022-46998 affects taocms v3.0.2: a vulnerability in the website background enables Server-Side Request Forgery (SSRF). CVSS 3.1 base score 9.8 (NETWORK, LOW complexity, NONE user interaction, HIGH impact on Confidentiality/Integrity/Availability). Documented exploitation exists (POC) per one...

Security Bulletin: Due to the use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to a SSRF attack (CVE-2021-39152, CVE-2021-39150)

Summary XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. Vulnerability Details...

Server-Side Request Forgery (SSRF)

rsshub is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists due to unsafe route parameter sanitation, which allows an attacker to send arbitrary HTTP requests from the server to other servers...

CVE-2023-24429

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

CVE-2023-24429

CVE-2023-24429 affects Jenkins Plugin: Semantic Versioning Plugin (versions ≤ 1.14). Root cause: XML parsing of a crafted controller/agent message that allows XML external entity (XXE) processing, enabling exfiltration of secrets from the Jenkins controller or triggering server-side requests. Imp...

CVE-2023-23560

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation...

Input validation

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation...

CVE-2021-43449

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...

CVE-2023-23560

CVE-2023-23560 affects Lexmark printers and multifunction devices with a server-side request forgery (SSRF) flaw caused by insufficient input validation in the vulnerable web interface. Reports indicate this can lead to arbitrary code execution with system privileges on affected devices, based on...

CVE-2023-23560

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation...

CVE-2021-43449

CVE-2021-43449 affects ONLYOFFICE all versions as of 2021-11-08. The Document Editor service is vulnerable to Server-Side Request Forgery (SSRF), enabling reading and serving arbitrary URLs as documents. CVSS v3.1 base score 8.1 (HIGH) with NETWORK attack vector, LOW attack complexity, no privile...

CVE-2021-43449

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...

CVE-2023-23560

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation...

OpenText Extended ECM 22.3 File Deletion / LFI / Privilege Escsalation Vulnerabilities

======================================================================= title: Multiple post-authentication vulnerabilities including RCE product: OpenText™ Content Server component of OpenText™ Extended ECM vulnerable version: 16.2.2 - 22.3 fixed version: 22.4 CVE number: CVE-2022-45924,...