Microsoft resolves four SSRF vulnerabilities in Azure cloud services

Summary Microsoft recently fixed a set of Server-Side Request Forgery SSRF vulnerabilities in four Azure services Azure API Management, Azure Functions, Azure Machine Learning, and Azure Digital Twins reported by Orca Security. These SSRF vulnerabilities were determined to be low risk as they do...

CVE-2022-4130

A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server...

GitLab 11.3 < 15.4.6 / 15.5 < 15.5.5 / 15.6 < 15.6.1 (CVE-2022-4201)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLa...

CVE-2023-22493

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery SSRF attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending ...

Server side request forgery (ssrf)

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery SSRF attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending ...

CVE-2023-22493

RSSHub (Node.js) is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by unsafe route parameter handling. An attacker can induce the server to issue arbitrary HTTP requests, potentially accessing internal resources. The issue is mitigated by patch commit a66cbcf in RSSHub, and...

CVE-2023-22493 RSSHub is vulnerable to SSRF (Server-Side Request Forgery)

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery SSRF attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending ...

CVE-2022-3841

RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery SSRF vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes RHACM. An attacker could take advantage of this as the console API endpoint is missing an...

Cisco TelePresence CE SSRF (cisco-sa-roomos-trav-beFvCcyu)

According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by a server-side request forgery SSRF vulnerability. Due to improper invalidation of user-supplied input, a local attacker could send arbitrary network requests that are sourced from the affecte...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

EXNESS: Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumeration

A blind stored server-side request forgery vulnerability was discovered in an endpoint of a website. This allowed internal network details to be disclosed by making requests to internal IP addresses and ports. With escalation, further inspection of the internal network could have been possible. T...

CVE-2022-25026

A Server-Side Request Forgery SSRF in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy...

CVE-2022-25026

CVE-2022-25026 is a Server-Side Request Forgery in Rocket TRUfusion Portal v7.9.2.1. An attacker can trigger requests to /trufusionPortal/upDwModuleProxy to access internal resources. CVSS v3.1 base score 7.5 (HIGH); vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No exploitation details or remediati...

RSSHub SSRF vulnerability

Summary RSSHub is vulnerable to Server-Side Request Forgery SSRF attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. Description An attacker can exploit this vulnerability by sending a request to the affected...

GHSA-64WP-JH9P-5CG2 RSSHub SSRF vulnerability

Summary RSSHub is vulnerable to Server-Side Request Forgery SSRF attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. Description An attacker can exploit this vulnerability by sending a request to the affected...

CVE-2022-3841

CVE-2022-3841 is an unauthenticated SSRF in the RHACM console API endpoint of Red Hat Advanced Cluster Management for Kubernetes. The vulnerability arises from a missing authentication check on the console API, enabling unauthenticated requests. CVSSv3.1 base score is 7.8 (High), with LOCAL attac...

CVE-2022-3841

RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery SSRF vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes RHACM. An attacker could take advantage of this as the console API endpoint is missing an...

Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to conduct server-side request forgery SSRF attacks through an affected device or to overwrite arbitrary files on an affected device. For more...