CVE-2022-40842

CVE-2022-40842 affects ndk design NdkAdvancedCustomizationFields 3.5.0 and is a Server-Side Request Forgery (SSRF) issue exposed via rotateimg.php. The CVSS v3.1 base score is 9.1 (CRITICAL) with network attack vector, no user interaction, and no privileges required; impact is confidentiality and...

CVE-2022-44784

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local File Inclusion. Among the exposed...

Default configuration

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local File Inclusion. Among the exposed...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository appsmithorg/appsmith prior to 1.8.2...

CVE-2022-44784

CVE-2022-44784 affects Maggioli Maggioli Appalti & Contratti 9.12.2, specifically the LFS and DL229 web applications that expose Axis 1.4 services embedded in the app. The Axis AdminService, intended for localhost only, can be reached remotely through the default configuration, enabling an attack...

CVE-2022-4096 Server-Side Request Forgery (SSRF) in appsmithorg/appsmith

Server-Side Request Forgery SSRF in GitHub repository appsmithorg/appsmith prior to 1.8.2...

XXL-JOB code issue vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community.A security vulnerability exists in versions prior to XXL-JOB v2.3.1, which stems from a vulnerability found via the component /admin/controller/JobLogController.java containing...

CVE-2022-4096

CVE-2022-4096 describes a Server-Side Request Forgery (SSRF) in the GitHub repository appsmithorg/appsmith before version 1.8.2. The vulnerability is triggered by a DNS rebinding-based SSRF that enables an attacker to make the server issue requests to internal/internal-facing targets, with potent...

CVE-2022-41609

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-41609

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

Server side request forgery (ssrf)

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-41609

The CVE concerns the WordPress Better Messages plugin, version 1.9.10.68 or earlier, which is vulnerable to an authenticated Server-Side Request Forgery (SSRF) when access is allowed to subscribers. The root cause involves the plugin validating parameters before making external/internal requests,...

GHSA-M5XF-X7Q6-3RM7 KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

PT-2022-25983 · Unknown · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin version 1.9.10.68 Description: The issue is related to an Authenticated Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially forge requests to internal or external services, but...

XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

XXL-Job before v2.4.0 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

EUVD-2022-7276

XXL-JOB vulnerable to Server-Side Request Forgery SSRF...

GHSA-83W4-X5W9-HF4H XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

XXL-Job before v2.4.0 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

CVE-2022-42894

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. An unauthenticated Server-Side Request Forgery SSRF vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as loca...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...