CWE-918 · Server-Side Request Forgery (SSRF) (page 24)
Page 24 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40969 | Medium | 6.1 | 2023-09-01 | Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php. |
CVE-2023-4651 | Medium | 5.4 | 2023-08-31 | Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4624 | Low | 2.4 | 2023-08-30 | Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. |
CVE-2023-40017 | High | 7.5 | 2023-08-24 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpo… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2023-37440 | Medium | 5.5 | 2023-08-22 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-sid… |
CVE-2023-24515 | Medium | 5.2 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API U… |
CVE-2022-44730 | Medium | 4.4 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A… |
CVE-2022-44729 | High | 7.1 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. O… |
CVE-2023-35011 | Medium | 5.4 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthori… |
CVE-2023-40033 | High | 7.1 | 2023-08-16 | Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) at… |
CVE-2023-3958 | High | 8.5 | 2023-08-16 | The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and in… |
CVE-2022-41401 | Medium | 6.5 | 2023-08-04 | OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading t… |
CVE-2023-26442 | Low | 3.2 | 2023-08-02 | In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to… |
CVE-2023-26438 | Medium | 4.3 | 2023-08-02 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers tha… |
CVE-2022-2416 | Medium | 5.5 | 2023-08-02 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. |
CVE-2023-39110 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authe… |
CVE-2023-39109 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. Thi… |
CVE-2023-39108 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. Thi… |
CVE-2022-42183 | Critical | 9.1 | 2023-07-31 | Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2023-3981 | Medium | 4.9 | 2023-07-27 | Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2. |
CVE-2021-35391 | High | 7.2 | 2023-07-21 | Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL. |
CVE-2023-37290 | High | 7.5 | 2023-07-20 | InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and al… |
CVE-2023-29260 | Medium | 6.5 | 2023-07-19 | IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized re… |
CVE-2023-3577 | Low | 3.5 | 2023-07-17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SS… |
CVE-2023-32052 | Medium | 5.4 | 2023-07-11 | Microsoft Power Apps (online) Spoofing Vulnerability |
CVE-2023-36925 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the a… |
CVE-2023-3578 | Medium | 5.5 | 2023-07-10 | A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The mani… |
CVE-2021-42079 | Medium | 6.2 | 2023-07-10 | An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepar… |
CVE-2023-37262 | Critical | 9.6 | 2023-07-07 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1… |
CVE-2023-37261 | Critical | 9.6 | 2023-07-07 | OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet C… |
CVE-2023-35175 | Critical | 9.8 | 2023-06-30 | Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forg… |
CVE-2023-3432 | Critical | 10.0 | 2023-06-27 | Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9. |
CVE-2023-33176 | Medium | 4.8 | 2023-06-26 | BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Reques… |
CVE-2023-36661 | High | 7.5 | 2023-06-25 | Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for exam… |
CVE-2023-35133 | High | 7.5 | 2023-06-22 | An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3… |
CVE-2023-26435 | Medium | 5.0 | 2023-06-20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restri… |
CVE-2023-26431 | Medium | 5.0 | 2023-06-20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use thi… |
CVE-2023-24243 | High | 7.5 | 2023-06-16 | CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). |
CVE-2023-29292 | Medium | 4.9 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerabili… |
CVE-2023-29291 | Medium | 4.9 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerabili… |
CVE-2023-21105 | Medium | 5.5 | 2023-06-15 | In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclos… |
CVE-2023-3238 | Medium | 6.3 | 2023-06-14 | A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?m… |
CVE-2023-3236 | Medium | 6.3 | 2023-06-14 | A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php… |
CVE-2023-3235 | Medium | 6.3 | 2023-06-14 | A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/… |
CVE-2023-3233 | Medium | 6.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/contro… |
CVE-2023-25609 | Medium | 4.3 | 2023-06-13 | A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4… |
CVE-2023-3188 | Medium | 6.5 | 2023-06-10 | Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0. |
CVE-2023-2249 | High | 8.8 | 2023-06-09 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and includi… |
CVE-2023-1895 | High | 8.5 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to… |
CVE-2023-32750 | Medium | 6.5 | 2023-06-08 | Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "rem… |
CVE-2023-34959 | Medium | 5.3 | 2023-06-08 | An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on t… |
CVE-2023-32683 | Low | 3.5 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklis… |
CVE-2023-3121 | Low | 3.5 | 2023-06-06 | A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the f… |
CVE-2023-28824 | Medium | 4.9 | 2023-06-01 | Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an admi… |
CVE-2023-23955 | High | 8.1 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability. |
CVE-2023-3015 | Medium | 6.3 | 2023-05-31 | A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-2927 | Medium | 6.3 | 2023-05-27 | A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipul… |
CVE-2023-33184 | Low | 3.5 | 2023-05-27 | Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that… |
CVE-2023-32348 | Medium | 5.8 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses Ope… |
CVE-2023-31848 | High | 8.8 | 2023-05-17 | davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF). |
CVE-2023-23169 | Medium | 6.5 | 2023-05-12 | Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. |
CVE-2022-29840 | Medium | 5.1 | 2023-05-10 | Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter w… |
CVE-2023-24954 | Medium | 6.5 | 2023-05-09 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2023-30019 | Medium | 5.3 | 2023-05-08 | imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter. |
CVE-2023-30444 | High | 7.1 | 2023-04-27 | IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to… |
CVE-2023-26735 | High | 7.5 | 2023-04-26 | blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet port… |
CVE-2022-48477 | Medium | 4.1 | 2023-04-24 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing |
CVE-2023-2140 | High | 7.5 | 2023-04-21 | A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to… |
CVE-2023-25504 | Medium | 4.9 | 2023-04-17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-… |
CVE-2018-17452 | Critical | 9.8 | 2023-04-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request… |
CVE-2018-17450 | Medium | 4.3 | 2023-04-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request… |
CVE-2022-43699 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls th… |
CVE-2022-43698 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. |
CVE-2023-28288 | High | 8.1 | 2023-04-11 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2023-1971 | Medium | 6.3 | 2023-04-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the… |
CVE-2023-29010 | Medium | 6.5 | 2023-04-06 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side… |
CVE-2023-29008 | High | 8.8 | 2023-04-06 | The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for… |
CVE-2023-28633 | Low | 3.5 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to ser… |
CVE-2023-27163 | Medium | 6.5 | 2023-03-31 | request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows at… |
CVE-2023-27162 | Critical | 9.1 | 2023-03-31 | openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability… |
CVE-2023-27160 | High | 7.2 | 2023-03-31 | forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to… |
CVE-2023-27159 | High | 7.5 | 2023-03-31 | Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers… |
CVE-2023-1725 | Critical | 9.8 | 2023-03-30 | Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Manageme… |
CVE-2023-25195 | High | 8.1 | 2023-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to se… |
CVE-2023-25262 | High | 7.5 | 2023-03-28 | Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to… |
CVE-2023-1634 | Medium | 6.3 | 2023-03-25 | A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component… |
CVE-2023-27586 | Critical | 9.9 | 2023-03-20 | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files… |
CVE-2023-28112 | Medium | 5.9 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being pas… |
CVE-2023-28111 | Medium | 5.7 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse… |
CVE-2023-28155 | Medium | 6.1 | 2023-03-16 | The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP… |
CVE-2023-27896 | Medium | 6.5 | 2023-03-14 | In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to con… |
CVE-2023-27271 | Medium | 6.5 | 2023-03-14 | In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the applicati… |
CVE-2023-26459 | High | 7.4 | 2023-03-14 | Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791… |
CVE-2023-27161 | High | 7.5 | 2023-03-10 | Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. This vulnerability allows attackers to a… |
CVE-2023-25230 | Medium | 4.9 | 2023-03-07 | A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url… |
CVE-2021-36396 | High | 7.5 | 2023-03-06 | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. |
CVE-2023-26492 | Medium | 5.0 | 2023-03-03 | Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a… |
CVE-2022-46973 | Critical | 9.8 | 2023-03-03 | Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability. |
CVE-2023-20062 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |