CWE-918 · Server-Side Request Forgery (SSRF) (page 20)
Page 20 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45290 | High | 7.7 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from… |
CVE-2024-9410 | Medium | 5.3 | 2024-10-04 | Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint. |
CVE-2024-45843 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibl… |
CVE-2024-47222 | Critical | 9.8 | 2024-09-23 | New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI p… |
CVE-2024-40441 | Medium | 6.6 | 2024-09-23 | An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document au… |
CVE-2024-47066 | Critical | 9.0 | 2024-09-23 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/ap… |
CVE-2024-43989 | High | 7.5 | 2024-09-23 | Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <… |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2022-25777 | Medium | 6.5 | 2024-09-18 | Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side… |
CVE-2024-38183 | Critical | 9.8 | 2024-09-17 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-47049 | High | 8.2 | 2024-09-17 | The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, l… |
CVE-2024-6587 | High | 7.5 | 2024-09-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` paramet… |
CVE-2024-8635 | High | 7.7 | 2024-09-12 | A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and… |
CVE-2021-38132 | Medium | 5.3 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2024-44677 | Critical | 9.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java… |
CVE-2023-37230 | High | 8.8 | 2024-09-10 | Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. |
CVE-2023-37229 | High | 8.8 | 2024-09-10 | Loftware Spectrum before 5.1 allows SSRF. |
CVE-2024-44721 | Critical | 9.8 | 2024-09-09 | SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php. |
CVE-2024-40718 | High | 8.8 | 2024-09-07 | A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability. |
CVE-2024-24759 | Critical | 9.3 | 2024-09-05 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request… |
CVE-2024-45507 | Critical | 9.8 | 2024-09-04 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-43371 | Medium | 4.5 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resou… |
CVE-2024-43379 | Low | 3.4 | 2024-08-19 | TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific dete… |
CVE-2022-1751 | High | 7.2 | 2024-08-17 | The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. Th… |
CVE-2024-22219 | Medium | 6.3 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-22217 | Medium | 6.5 | 2024-08-15 | A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal service… |
CVE-2024-7743 | High | 7.3 | 2024-08-13 | A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file… |
CVE-2024-7742 | High | 7.3 | 2024-08-13 | A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDow… |
CVE-2024-7740 | High | 7.3 | 2024-08-13 | A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/do… |
CVE-2024-38109 | Critical | 9.1 | 2024-08-13 | An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network. |
CVE-2024-41737 | Medium | 5.0 | 2024-08-13 | SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On… |
CVE-2024-41651 | High | 8.1 | 2024-08-12 | An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by mu… |
CVE-2024-42467 | Critical | 10.0 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the… |
CVE-2024-41570 | Critical | 9.8 | 2024-08-12 | An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating… |
CVE-2024-39338 | High | 7.5 | 2024-08-12 | axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. |
CVE-2024-6522 | High | 8.5 | 2024-08-07 | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form… |
CVE-2024-38206 | High | 8.5 | 2024-08-06 | An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. |
CVE-2024-42352 | High | 8.6 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon… |
CVE-2024-36448 | High | 7.3 | 2024-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0… |
CVE-2024-39713 | High | 8.6 | 2024-08-05 | A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. |
CVE-2024-39637 | Medium | 5.4 | 2024-08-01 | Server-Side Request Forgery (SSRF) vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through <= 9.2.0. |
CVE-2024-38791 | Medium | 4.9 | 2024-08-01 | Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: Chat… |
CVE-2024-2090 | Medium | 6.4 | 2024-08-01 | The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content… |
CVE-2024-7330 | Medium | 6.3 | 2024-08-01 | A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curl_exec of the file /App/Core/Exten… |
CVE-2024-6980 | Critical | 9.8 | 2024-07-31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Thi… |
CVE-2024-41305 | Medium | 4.7 | 2024-07-30 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection… |
CVE-2024-41120 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41118 | High | 7.5 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41813 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1… |
CVE-2024-41812 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Fo… |
CVE-2024-6922 | | 2024-07-26 | Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the… | |
CVE-2024-41668 | High | 8.3 | 2024-07-23 | The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed pro… |
CVE-2024-41664 | Medium | 5.4 | 2024-07-23 | Canarytokens help track activity and actions on a network. Prior to `sha-8ea5315`, Canarytokens.org was vulnerable to a blind SSRF in the Webhook alert feature… |
CVE-2024-4260 | Medium | 6.5 | 2024-07-23 | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a… |
CVE-2024-38730 | Medium | 4.9 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1… |
CVE-2024-38728 | High | 7.2 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from… |
CVE-2024-38723 | Medium | 6.4 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6. |
CVE-2024-37942 | High | 7.2 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5. |
CVE-2024-38758 | Medium | 4.9 | 2024-07-20 | Server-Side Request Forgery (SSRF) vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 6.0.4. |
CVE-2024-29736 | Critical | 9.1 | 2024-07-19 | A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on RE… |
CVE-2024-21527 | High | 8.2 | 2024-07-19 | Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chr… |
CVE-2024-30125 | Medium | 6.2 | 2024-07-18 | HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. |
CVE-2024-40898 | High | 7.5 | 2024-07-18 | SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malic… |
CVE-2024-31979 | Medium | 4.3 | 2024-07-17 | Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users… |
CVE-2023-31456 | Medium | 5.4 | 2024-07-16 | There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to in… |
CVE-2024-40632 | Low | 3.7 | 2024-07-15 | Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptibl… |
CVE-2024-36458 | | 2024-07-15 | The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions. | |
CVE-2024-39739 | Medium | 5.4 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2024-40544 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
CVE-2024-40543 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
CVE-2024-32987 | High | 7.5 | 2024-07-09 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2024-37171 | Medium | 5.0 | 2024-07-09 | SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web appl… |
CVE-2024-34689 | Medium | 5.0 | 2024-07-09 | WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting… |
CVE-2024-39598 | Medium | 5.0 | 2024-07-09 | SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP req… |
CVE-2024-39699 | Medium | 5.0 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed… |
CVE-2024-31897 | Medium | 4.3 | 2024-07-08 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, a… |
CVE-2024-6095 | Medium | 5.8 | 2024-07-06 | A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion… |
CVE-2024-37260 | High | 7.2 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5. |
CVE-2024-37208 | Medium | 4.9 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7. |
CVE-2024-34361 | High | 8.5 | 2024-07-05 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3… |
CVE-2024-39687 | High | 7.2 | 2024-07-05 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an obje… |
CVE-2024-29319 | Critical | 9.8 | 2024-07-05 | Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and… |
CVE-2024-6524 | Medium | 5.5 | 2024-07-05 | A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file exten… |
CVE-2024-37157 | Medium | 6.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-38472 | High | 7.5 | 2024-07-01 | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recomm… |
CVE-2024-6424 | Critical | 9.3 | 2024-07-01 | External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/P… |
CVE-2023-50952 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reque… |
CVE-2024-38514 | High | 7.4 | 2024-06-28 | NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET p… |
CVE-2024-5736 | High | 7.5 | 2024-06-28 | Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages avail… |
CVE-2024-5885 | High | 8.6 | 2024-06-27 | stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not provide sufficient controls when crawlin… |
CVE-2024-5822 | Critical | 9.8 | 2024-06-27 | A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-… |
CVE-2024-37098 | Medium | 4.4 | 2024-06-26 | Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a t… |
CVE-2024-34581 | High | 7.3 | 2024-06-26 | The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may… |
CVE-2024-34580 | Medium | 5.3 | 2024-06-26 | Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload… |
CVE-2024-29173 | Medium | 6.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote hig… |
CVE-2024-5015 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low pri… |
CVE-2024-5014 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticate… |
CVE-2023-45195 | Medium | 5.3 | 2024-06-24 | Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access system… |
CVE-2024-5746 | High | 7.6 | 2024-06-20 | A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitr… |
CVE-2024-37818 | High | 8.6 | 2024-06-20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to… |