CWE-918 · Server-Side Request Forgery (SSRF) (page 22)
Page 22 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25864 | Critical | 9.1 | 2024-04-03 | Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive… |
CVE-2024-30532 | Medium | 4.9 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from… |
CVE-2024-30531 | Medium | 4.9 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0. |
CVE-2024-24888 | Medium | 6.4 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence… |
CVE-2024-25187 | High | 8.6 | 2024-04-02 | Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html. |
CVE-2024-30453 | Medium | 5.4 | 2024-03-29 | Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2024-27775 | High | 7.2 | 2024-03-28 | SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash |
CVE-2023-50374 | Medium | 5.5 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a th… |
CVE-2024-29090 | Medium | 6.8 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4. |
CVE-2024-23500 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence… |
CVE-2023-39313 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-36679 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-34370 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Prem… |
CVE-2024-0677 | Medium | 5.1 | 2024-03-28 | The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege… |
CVE-2024-2206 | Medium | 6.5 | 2024-03-27 | An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vu… |
CVE-2024-28435 | Medium | 5.4 | 2024-03-25 | The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. |
CVE-2024-29190 | High | 7.5 | 2024-03-22 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In ve… |
CVE-2024-2828 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/jav… |
CVE-2024-2827 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file… |
CVE-2024-27927 | Medium | 6.5 | 2024-03-21 | RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GE… |
CVE-2024-24028 | Medium | 5.9 | 2024-03-21 | Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function U… |
CVE-2024-25294 | Critical | 9.1 | 2024-03-20 | An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,U… |
CVE-2024-27098 | Medium | 6.4 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-28752 | Critical | 9.3 | 2024-03-15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on we… |
CVE-2024-1884 | Medium | 6.5 | 2024-03-14 | This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side applicat… |
CVE-2024-28668 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php |
CVE-2024-2049 | Medium | 6.5 | 2024-03-12 | Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited in… |
CVE-2023-49785 | Critical | 9.1 | 2024-03-12 | NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side… |
CVE-2024-27707 | Medium | 4.3 | 2024-03-07 | Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file. |
CVE-2024-27565 | Critical | 9.8 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary reques… |
CVE-2024-27564 | Medium | 5.8 | 2024-03-05 | pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of picturepro… |
CVE-2024-27563 | Medium | 5.3 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests v… |
CVE-2024-27561 | High | 8.1 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbit… |
CVE-2022-43880 | Medium | 4.4 | 2024-03-03 | IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151. |
CVE-2024-2057 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/… |
CVE-2024-27949 | Medium | 5.4 | 2024-03-01 | Server-Side Request Forgery (SSRF) vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-0403 | Medium | 6.5 | 2024-03-01 | Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF. |
CVE-2024-1978 | Medium | 5.5 | 2024-02-29 | The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_available_feeds func… |
CVE-2022-34269 | High | 8.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to de… |
CVE-2024-26476 | Low | 3.5 | 2024-02-28 | An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component. |
CVE-2024-1965 | Medium | 6.5 | 2024-02-28 | Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal… |
CVE-2024-1568 | Medium | 6.4 | 2024-02-28 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_… |
CVE-2024-0759 | High | 7.5 | 2024-02-27 | Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could li… |
CVE-2024-22873 | High | 8.1 | 2024-02-26 | Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscriptio… |
CVE-2024-1758 | Medium | 5.4 | 2024-02-26 | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_c… |
CVE-2024-0455 | High | 7.5 | 2024-02-26 | The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in… |
CVE-2024-0440 | Medium | 6.5 | 2024-02-26 | Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and ot… |
CVE-2024-0243 | High | 8.1 | 2024-02-26 | With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=ur… |
CVE-2024-25915 | Medium | 4.9 | 2024-02-23 | Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2… |
CVE-2024-23654 | Medium | 4.1 | 2024-02-21 | discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with di… |
CVE-2023-47635 | Medium | 4.5 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabl… |
CVE-2024-21498 | Medium | 5.3 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. A… |
CVE-2023-5122 | Medium | 5.0 | 2024-02-14 | Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for… |
CVE-2024-23788 | High | 8.1 | 2024-02-14 | Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjace… |
CVE-2024-23761 | Critical | 9.8 | 2024-02-12 | Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template. |
CVE-2023-6294 | High | 7.2 | 2024-02-12 | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator rol… |
CVE-2024-24829 | Medium | 4.3 | 2024-02-09 | Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. On… |
CVE-2023-42282 | Critical | 9.8 | 2024-02-08 | The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPubli… |
CVE-2024-24113 | High | 8.8 | 2024-02-08 | xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. |
CVE-2024-24806 | High | 7.3 | 2024-02-07 | libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterp… |
CVE-2024-0628 | Low | 3.8 | 2024-02-07 | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in… |
CVE-2023-6388 | Medium | 5.0 | 2024-02-07 | Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. |
CVE-2023-22817 | Medium | 5.5 | 2024-02-05 | Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back… |
CVE-2024-21893 | High | 8.2 | 2024-01-31 | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons… |
CVE-2023-50165 | High | 8.5 | 2024-01-31 | Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. |
CVE-2023-47116 | Medium | 5.3 | 2024-01-31 | Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8… |
CVE-2023-44313 | High | 7.6 | 2024-01-31 | Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially craf… |
CVE-2024-23838 | High | 7.5 | 2024-01-30 | TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the Ht… |
CVE-2024-23825 | Low | 3.0 | 2024-01-30 | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That use… |
CVE-2024-1063 | Medium | 5.3 | 2024-01-30 | Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. |
CVE-2024-22648 | Medium | 5.3 | 2024-01-30 | A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports… |
CVE-2024-1021 | Medium | 6.3 | 2024-01-29 | A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component H… |
CVE-2024-0946 | High | 7.3 | 2024-01-26 | A vulnerability classified as critical was found in 60IndexPage up to 1.8.5. This vulnerability affects unknown code of the file /apply/index.php of the compon… |
CVE-2024-0945 | High | 7.3 | 2024-01-26 | A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5. This affects an unknown part of the file /include/file.php of the component P… |
CVE-2024-22134 | Medium | 4.9 | 2024-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailch… |
CVE-2023-52331 | High | 7.1 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local se… |
CVE-2023-38627 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38626 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38625 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38624 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2024-23330 | Medium | 5.3 | 2024-01-23 | Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the d… |
CVE-2024-22205 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location`… |
CVE-2024-22203 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `s… |
CVE-2022-40700 | High | 8.2 | 2024-01-19 | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone… |
CVE-2023-32337 | Medium | 5.4 | 2024-01-19 | IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2024-0649 | Medium | 6.3 | 2024-01-17 | A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Co… |
CVE-2024-22408 | High | 7.6 | 2024-01-16 | Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL use… |
CVE-2024-0601 | Medium | 6.3 | 2024-01-16 | A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src… |
CVE-2023-6991 | High | 8.8 | 2024-01-15 | The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which co… |
CVE-2024-0510 | High | 7.3 | 2024-01-13 | A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file… |
CVE-2023-51804 | High | 7.5 | 2024-01-13 | An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api… |
CVE-2023-49471 | High | 8.8 | 2024-01-10 | Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request t… |
CVE-2024-0308 | Medium | 6.3 | 2024-01-08 | A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default… |
CVE-2024-0304 | Medium | 6.3 | 2024-01-08 | A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/… |
CVE-2024-0303 | Medium | 6.3 | 2024-01-08 | A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php… |
CVE-2023-51441 | High | 7.2 | 2024-01-06 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF … |
CVE-2024-21642 | High | 7.5 | 2024-01-05 | D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF… |
CVE-2023-51676 | Medium | 4.9 | 2023-12-29 | Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1. |
CVE-2023-7078 | High | 7.5 | 2023-12-29 | Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare wa… |