CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

Server side request forgery (ssrf)

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

Server-Side Request Forgery (SSRF)

github.com/kubevela/kubevela is vulnerable to server-side request forgery. The vulnerability is due to common.go because the request address in the warehouse is not properly restricted which allows an attacker to cause a SSRF bypass via a crafted url...

CVE-2022-42894

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. An unauthenticated Server-Side Request Forgery SSRF vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as loca...

CVE-2022-43183

XXL-JOB prior to v2.3.1 is affected by a Server-Side Request Forgery (SSRF) in the component /admin/controller/JobLogController.java . The issue stems from the code path handling JobLog operations, enabling SSRF according to multiple connected sources. The public CVE entry CVE-2022-43183 consolid...

CVE-2022-43140

kkFileView 4.1.0 is vulnerable to a Server-Side Request Forgery (SSRF) in cn.keking.web.controller.OnlinePreviewController#getCorsFile. By injecting crafted URLs into the url parameter, an attacker can force the application to make arbitrary outbound requests, potentially exposing internal resour...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

WordPress All in One SEO Pack Plugin < 4.2.6 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aioseo:allinoneseo"; if description...

CVE-2022-42894

Siemens syngo Dynamics is affected by an unauthenticated Server-Side Request Forgery (SSRF) in a web service exposed by the application for all versions prior to VA40G HF01. The vulnerability can leak NTLM credentials and enable local service enumeration. Public documentation across multiple sour...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

CVE-2022-43183

XXL-Job before v2.3.1 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

CVE-2022-39383

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

Server side request forgery (ssrf)

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

Server side request forgery (ssrf)

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

CVE-2022-39383 SSRF vulnerability in KubeVela VelaUX APIServer

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

CVE-2022-39383 SSRF vulnerability in KubeVela VelaUX APIServer

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

CVE-2022-39383

CVE-2022-39383 describes a blind SSRF in the KubeVela VelaUX APIserver when using Helm Chart as the component delivery method, where the warehouse request address is not restricted. This affects KubeVela’s VelaUX APIserver and enables an SSRF vulnerability. Public reports and advisories (GitHub G...