CWE-918 · Server-Side Request Forgery (SSRF) (page 25)
Page 25 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37938 | Critical | 9.8 | 2023-03-01 | Unauthenticated server side request forgery in HPE Serviceguard Manager |
CVE-2023-1046 | Medium | 6.3 | 2023-02-26 | A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation… |
CVE-2022-4492 | High | 7.5 | 2023-02-23 | The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should… |
CVE-2022-48321 | Medium | 6.8 | 2023-02-20 | Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted e… |
CVE-2021-33926 | High | 8.8 | 2023-02-17 | An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5… |
CVE-2022-27234 | Medium | 4.3 | 2023-02-16 | Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information… |
CVE-2023-22936 | Medium | 6.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF… |
CVE-2023-25162 | Medium | 5.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Ent… |
CVE-2022-45085 | Medium | 6.5 | 2023-02-12 | Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affe… |
CVE-2023-25557 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this… |
CVE-2023-0574 | Medium | 6.8 | 2023-02-09 | Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentic… |
CVE-2023-23943 | Medium | 5.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal s… |
CVE-2022-47872 | High | 8.8 | 2023-02-01 | A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload inj… |
CVE-2022-37033 | Medium | 6.5 | 2023-02-01 | In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addre… |
CVE-2023-24623 | High | 7.5 | 2023-01-30 | Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses. |
CVE-2023-24622 | Medium | 5.3 | 2023-01-30 | isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF. |
CVE-2022-4201 | Low | 3.5 | 2023-01-27 | A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local add… |
CVE-2022-4335 | Medium | 4.3 | 2023-01-27 | A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker… |
CVE-2023-24060 | Medium | 5.0 | 2023-01-27 | Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or… |
CVE-2023-24495 | Medium | 6.5 | 2023-01-26 | A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authe… |
CVE-2022-46998 | Critical | 9.8 | 2023-01-26 | An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF). |
CVE-2023-23560 | Critical | 9.8 | 2023-01-23 | In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. |
CVE-2021-43449 | High | 8.1 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbit… |
CVE-2021-37498 | Medium | 6.5 | 2023-01-20 | An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intran… |
CVE-2023-20002 | Medium | 4.4 | 2023-01-20 | A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack… |
CVE-2022-45926 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evalua… |
CVE-2023-22493 | High | 8.8 | 2023-01-13 | RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send… |
CVE-2022-3841 | High | 7.8 | 2023-01-13 | RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Adva… |
CVE-2022-25026 | High | 7.5 | 2023-01-12 | A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network… |
CVE-2023-21761 | High | 7.5 | 2023-01-10 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2022-39039 | Critical | 9.8 | 2023-01-03 | aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s… |
CVE-2022-45027 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address. |
CVE-2017-20157 | Medium | 5.5 | 2022-12-31 | A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.p… |
CVE-2022-38212 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-38211 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and… |
CVE-2022-38203 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-23544 | High | 7.2 | 2022-12-28 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-45429 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL)… |
CVE-2022-4725 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/mai… |
CVE-2022-37313 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
CVE-2022-3189 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to… |
CVE-2022-47635 | Critical | 9.8 | 2022-12-21 | Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php. |
CVE-2022-38708 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-contro… |
CVE-2022-42343 | Medium | 6.5 | 2022-12-16 | Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitr… |
CVE-2022-46364 | Critical | 9.8 | 2022-12-13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perf… |
CVE-2022-41949 | Medium | 5.0 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2… |
CVE-2022-46830 | Medium | 4.1 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
CVE-2022-35508 | Critical | 9.8 | 2022-12-04 | Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. A… |
CVE-2022-41412 | High | 8.6 | 2022-11-30 | An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF)… |
CVE-2022-45152 | Critical | 9.1 | 2022-11-25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI pro… |
CVE-2022-40842 | Critical | 9.1 | 2022-11-22 | ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. |
CVE-2022-4096 | Medium | 6.5 | 2022-11-21 | Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. |
CVE-2022-41609 | Medium | 6.4 | 2022-11-19 | Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. |
CVE-2022-43183 | High | 8.8 | 2022-11-17 | XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java. |
CVE-2022-43140 | High | 7.5 | 2022-11-17 | kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile… |
CVE-2022-42894 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was iden… |
CVE-2022-39383 | Medium | 4.9 | 2022-11-16 | KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as th… |
CVE-2022-41906 | High | 8.7 | 2022-11-11 | OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-h… |
CVE-2022-42494 | Low | 3.0 | 2022-11-08 | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. |
CVE-2022-20958 | High | 8.3 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a se… |
CVE-2022-20951 | High | 7.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a serv… |
CVE-2022-39276 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39241 | High | 7.6 | 2022-11-02 | Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts o… |
CVE-2022-41552 | Critical | 9.8 | 2022-11-01 | Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hita… |
CVE-2022-40296 | Critical | 9.8 | 2022-10-31 | The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially includ… |
CVE-2022-3708 | Critical | 9.6 | 2022-10-28 | The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URL… |
CVE-2022-43776 | Medium | 6.5 | 2022-10-26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented bl… |
CVE-2022-36451 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Requ… |
CVE-2022-42890 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics p… |
CVE-2022-41704 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16… |
CVE-2022-3247 | Medium | 6.5 | 2022-10-25 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the… |
CVE-2022-38580 | Critical | 9.8 | 2022-10-25 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2022-27622 | Medium | 4.1 | 2022-10-25 | Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authentic… |
CVE-2022-39055 | Medium | 5.3 | 2022-10-18 | RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack to discover internal… |
CVE-2022-42149 | Critical | 9.8 | 2022-10-17 | kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. |
CVE-2022-41477 | Critical | 9.1 | 2022-10-14 | A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inj… |
CVE-2022-36802 | Medium | 4.9 | 2022-10-14 | The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources… |
CVE-2022-41497 | Critical | 9.8 | 2022-10-13 | ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php. |
CVE-2022-41496 | Critical | 9.8 | 2022-10-13 | iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php. |
CVE-2022-41495 | Critical | 9.8 | 2022-10-13 | ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php. |
CVE-2022-36551 | Medium | 6.5 | 2022-10-03 | A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated u… |
CVE-2022-41040 | High | 8.8 | 2022-10-03 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-35282 | Medium | 6.5 | 2022-09-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacke… |
CVE-2022-2352 | High | 7.2 | 2022-09-26 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users su… |
CVE-2022-23464 | Medium | 4.3 | 2022-09-24 | Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTempla… |
CVE-2022-39239 | Medium | 6.1 | 2022-09-23 | netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by s… |
CVE-2022-40146 | High | 7.5 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache… |
CVE-2022-38648 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML… |
CVE-2022-38398 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apa… |
CVE-2022-40357 | Critical | 9.8 | 2022-09-20 | A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php… |
CVE-2022-38931 | High | 8.8 | 2022-09-20 | A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary… |
CVE-2022-30579 | High | 7.1 | 2022-09-20 | The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to explo… |
CVE-2022-39211 | Low | 3.0 | 2022-09-16 | Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erron… |
CVE-2022-2912 | Medium | 4.3 | 2022-09-16 | The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value perfor… |
CVE-2022-36112 | Low | 3.5 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-2900 | Critical | 9.1 | 2022-09-14 | Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0. |
CVE-2022-38298 | High | 8.8 | 2022-09-12 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS… |
CVE-2022-38292 | Critical | 9.8 | 2022-09-12 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php an… |
CVE-2022-36376 | Medium | 6.8 | 2022-09-09 | Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress. |
CVE-2022-40305 | Critical | 9.8 | 2022-09-09 | A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibl… |