CWE-918 · Server-Side Request Forgery (SSRF) (page 23)
Page 23 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51697 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51665 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-50968 | High | 7.5 | 2023-12-26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri… |
CVE-2023-51451 | Medium | 4.3 | 2023-12-22 | Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTT… |
CVE-2023-50731 | Critical | 9.1 | 2023-12-22 | MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not val… |
CVE-2023-50714 | Medium | 6.8 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-50259 | Medium | 5.3 | 2023-12-22 | Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF)… |
CVE-2023-50258 | Medium | 5.3 | 2023-12-22 | Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF)… |
CVE-2023-7037 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController… |
CVE-2023-6974 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execut… |
CVE-2023-46262 | High | 7.5 | 2023-12-19 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control serve… |
CVE-2022-40312 | Medium | 5.5 | 2023-12-18 | Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fu… |
CVE-2023-6853 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugi… |
CVE-2023-6852 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.ph… |
CVE-2023-6849 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileT… |
CVE-2023-50266 | Medium | 5.3 | 2023-12-15 | Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url va… |
CVE-2023-49159 | High | 7.2 | 2023-12-15 | Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4. |
CVE-2023-48379 | Medium | 5.3 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticat… |
CVE-2023-6570 | Medium | 6.5 | 2023-12-14 | Server-Side Request Forgery (SSRF) in kubeflow/kubeflow |
CVE-2023-40630 | Critical | 9.8 | 2023-12-14 | Unauthenticated LFI/SSRF in JCDashboards component for Joomla. |
CVE-2023-47619 | High | 8.1 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, d… |
CVE-2023-49795 | Medium | 6.5 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`… |
CVE-2023-49799 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforeme… |
CVE-2023-49746 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Opt… |
CVE-2023-46641 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24. |
CVE-2023-41804 | High | 7.1 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Sta… |
CVE-2022-45362 | High | 7.2 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0. |
CVE-2023-46736 | Medium | 5.3 | 2023-12-05 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via t… |
CVE-2023-48910 | Critical | 9.8 | 2023-12-04 | Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows… |
CVE-2023-46746 | Medium | 4.8 | 2023-12-01 | PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF… |
CVE-2023-49094 | Medium | 4.3 | 2023-11-30 | Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET… |
CVE-2023-6070 | Medium | 4.3 | 2023-11-29 | A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially… |
CVE-2023-48023 | Critical | 9.1 | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation… |
CVE-2023-48022 | Critical | 9.8 | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is… |
CVE-2023-46480 | Critical | 9.8 | 2023-11-27 | An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth fun… |
CVE-2023-5974 | Critical | 9.8 | 2023-11-27 | The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter. |
CVE-2023-48711 | Low | 3.7 | 2023-11-24 | google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is presen… |
CVE-2023-27451 | High | 7.2 | 2023-11-22 | Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions. |
CVE-2023-48307 | Low | 3.5 | 2023-11-21 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker… |
CVE-2023-48306 | Medium | 5.0 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-6199 | Medium | 6.5 | 2023-11-20 | Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF. |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-48204 | Medium | 6.5 | 2023-11-16 | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHt… |
CVE-2023-6124 | Medium | 4.3 | 2023-11-14 | Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. |
CVE-2023-46207 | Medium | 4.1 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifie… |
CVE-2023-41239 | Medium | 6.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry… |
CVE-2023-38515 | Medium | 5.5 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56. |
CVE-2023-37978 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11. |
CVE-2023-34013 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll… |
CVE-2023-31219 | Medium | 4.1 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1. |
CVE-2023-23800 | High | 7.1 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue affects WP Shortcodes Plugin — Shortcode… |
CVE-2023-23684 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5. |
CVE-2022-45835 | Medium | 5.8 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15. |
CVE-2023-47121 | Low | 3.4 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-46729 | Critical | 9.3 | 2023-11-10 | sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and r… |
CVE-2023-42361 | High | 7.8 | 2023-11-07 | Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arb… |
CVE-2023-46730 | High | 7.4 | 2023-11-07 | Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.ph… |
CVE-2022-3172 | Medium | 5.1 | 2023-11-03 | A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client… |
CVE-2023-39301 | Medium | 4.3 | 2023-11-03 | A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2023-4769 | Medium | 6.6 | 2023-11-03 | A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability coul… |
CVE-2023-43982 | Critical | 9.8 | 2023-11-03 | Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.p… |
CVE-2023-35896 | Medium | 5.4 | 2023-11-03 | IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from t… |
CVE-2023-46725 | High | 8.1 | 2023-11-02 | FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery… |
CVE-2023-46236 | High | 8.6 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability… |
CVE-2023-46502 | Critical | 9.8 | 2023-10-30 | An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. |
CVE-2023-43798 | Medium | 5.6 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). T… |
CVE-2023-46124 | High | 8.2 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of priv… |
CVE-2023-43795 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specifica… |
CVE-2023-41339 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>``… |
CVE-2023-45966 | High | 7.5 | 2023-10-23 | umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability. |
CVE-2023-46303 | High | 7.5 | 2023-10-22 | link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. |
CVE-2023-44256 | Medium | 6.5 | 2023-10-20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager ve… |
CVE-2023-41899 | Medium | 6.6 | 2023-10-19 | Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an… |
CVE-2023-45822 | Low | 3.7 | 2023-10-19 | Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit… |
CVE-2023-25753 | Medium | 6.5 | 2023-10-19 | There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arb… |
CVE-2023-46229 | High | 8.8 | 2023-10-19 | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. |
CVE-2023-45152 | Low | 2.0 | 2023-10-17 | Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against t… |
CVE-2023-45660 | Medium | 4.3 | 2023-10-16 | Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacke… |
CVE-2023-5572 | Critical | 9.8 | 2023-10-13 | Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-26366 | Medium | 6.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Requ… |
CVE-2023-41763 | Medium | 5.3 | 2023-10-10 | Skype for Business Elevation of Privilege Vulnerability |
CVE-2023-42477 | Medium | 6.5 | 2023-10-10 | SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limi… |
CVE-2023-39854 | Medium | 6.5 | 2023-10-09 | The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to inclu… |
CVE-2023-44384 | Medium | 4.1 | 2023-10-06 | Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make a… |
CVE-2023-3744 | Critical | 9.9 | 2023-10-02 | Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal service… |
CVE-2023-44469 | Medium | 4.3 | 2023-09-29 | A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to a… |
CVE-2023-43654 | Critical | 10.0 | 2023-09-28 | TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parti… |
CVE-2023-41449 | Critical | 9.8 | 2023-09-27 | An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter. |
CVE-2023-42812 | Medium | 6.3 | 2023-09-22 | Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious… |
CVE-2023-42450 | Medium | 5.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specifi… |
CVE-2023-3025 | High | 7.2 | 2023-09-16 | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. Th… |
CVE-2023-42439 | High | 7.5 | 2023-09-15 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in ve… |
CVE-2023-42398 | Critical | 9.8 | 2023-09-15 | An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. |
CVE-2023-4893 | Medium | 6.4 | 2023-09-12 | The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2… |
CVE-2023-4878 | Medium | 5.4 | 2023-09-10 | Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-41327 | Medium | 4.6 | 2023-09-06 | WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achiev… |
CVE-2023-39967 | Critical | 10.0 | 2023-09-06 | WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request mi… |
CVE-2023-41937 | High | 7.5 | 2023-09-06 | Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and… |
CVE-2023-36388 | Medium | 4.3 | 2023-09-06 | Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF. |