CVE-2022-41906 OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing...

Server side request forgery (ssrf)

An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML such as an SSRF payload into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field...

CVE-2022-26088

CVE-2022-26088 affects BMC Remedy ITSM Suite prior to 22.1. Email-based Incident Forwarding can let remote authenticated users inject HTML (including SSRF payloads) into the Activity Log by placing content in the To: field, influencing rendering when the number of recipients is clicked. The vulne...

PT-2022-17659 · Bmc · Bmc Remedy

Name of the Vulnerable Software and Affected Versions: BMC Remedy versions prior to 22.1 Description: An issue was discovered in BMC Remedy where Email-based Incident Forwarding allows remote authenticated users to inject HTML, such as an SSRF payload, into the Activity Log by placing it in the T...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM InfoSphere Master Data Management is affected by vulnerbility in IBM WebSphere Application Server to a server-side request forgery vulnerability. This has been addressed. Vulnerability Details CVEID:CVE-2022-35282 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is...

Server side request forgery (ssrf)

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce...

CVE-2022-42494

Server Side Request Forgery SSRF vulnerability in All in One SEO Pro plugin = 4.2.5.1 on WordPress...

CVE-2022-42494

Summary of the CVE-2022-42494 (All in One SEO Pro) : A SSRF vulnerability affects WordPress All in One SEO Pro plugin versions ≤ 4.2.5.1. The issue arises from insufficient validation when the plugin makes outbound requests, enabling an attacker to proxy requests from the vulnerable server. Sever...

CVE-2022-20951

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

Server side request forgery (ssrf)

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. ...

Metabase SSRF (CVE-2022-39359)

The version of Metabase installed on the remote host is 0.41.9, 0.42.6, 0.43.7, 0.44.5, 1.41.9, 1.42.6, 1.43.7 or 1.44.5. It is, therefore, affected by a server side request forgery vulnerability exists in Metabase due to a feature in the /api/geojson endpoint of Metabase which will make a web...

Security fix for the ALT Linux 10 package glpi version 9.5.10-alt1

Nov. 4, 2022 Pavel Zilke 9.5.10-alt1 - New version 9.5.10 - This release fixes several security issues that has been recently discovered. Update is recommended! - Security fixes: + CVE-2022-39276 : Blind SSRF in RSS feeds and planning + CVE-2022-39372 : Stored XSS in user information +...

CVE-2022-20958

The CVE-2022-20958 issue affects Cisco BroadWorks CommPilot Web-based Management Interface. The vulnerability is due to insufficient validation of user-supplied input, enabling an unauthenticated remote attacker to perform a server-side request forgery (SSRF) against the BroadWorks server and oth...

CVE-2022-20958

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. ...

CVE-2022-20951

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2022-20951

The CVE-2022-20951 entry affects Cisco BroadWorks CommPilot (web-based management interface). Affects an authenticated, remote attacker via input validation flaws that enable server-side request forgery (SSRF) to access confidential information on the BroadWorks server or other network devices. I...

CVE-2022-20951

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2022-39276

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote...

CVE-2022-39276 Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote...