CWE-918 · Server-Side Request Forgery (SSRF) (page 26)
Page 26 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31196 | High | 7.6 | 2022-09-02 | Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sendin… |
CVE-2021-27693 | Critical | 9.8 | 2022-09-02 | Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage. |
CVE-2022-2556 | Low | 2.7 | 2022-08-29 | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the serv… |
CVE-2022-2267 | Medium | 4.3 | 2022-08-29 | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request o… |
CVE-2022-35583 | Critical | 9.8 | 2022-08-22 | wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP… |
CVE-2022-38187 | High | 7.5 | 2022-08-15 | Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attac… |
CVE-2020-23622 | High | 7.5 | 2022-08-15 | An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in… |
CVE-2022-35949 | Medium | 5.3 | 2022-08-12 | undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user… |
CVE-2022-37041 | High | 7.5 | 2022-08-12 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header… |
CVE-2022-2756 | Medium | 6.5 | 2022-08-10 | Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1. |
CVE-2022-31132 | High | 8.3 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css… |
CVE-2022-31188 | High | 8.6 | 2022-08-01 | CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side reques… |
CVE-2022-31776 | High | 8.8 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request f… |
CVE-2022-36997 | High | 7.1 | 2022-07-28 | An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBa… |
CVE-2021-43959 | Medium | 5.7 | 2022-07-26 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network re… |
CVE-2022-32457 | Medium | 5.3 | 2022-07-20 | Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology… |
CVE-2022-22416 | Medium | 5.4 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at… |
CVE-2022-25801 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. |
CVE-2022-25800 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. |
CVE-2022-22982 | High | 7.5 | 2022-07-13 | The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit… |
CVE-2022-2339 | High | 7.5 | 2022-07-07 | With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of… |
CVE-2022-25876 | Medium | 6.2 | 2022-07-01 | The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local n… |
CVE-2022-26135 | Medium | 6.5 | 2022-06-30 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to p… |
CVE-2022-0085 | Medium | 5.3 | 2022-06-28 | Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0. |
CVE-2017-20106 | Medium | 5.3 | 2022-06-28 | A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose… |
CVE-2022-32995 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. |
CVE-2022-2216 | Critical | 9.8 | 2022-06-27 | Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-1977 | High | 7.2 | 2022-06-27 | The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before maki… |
CVE-2021-20544 | Medium | 4.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to sen… |
CVE-2021-20421 | Medium | 4.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to sen… |
CVE-2022-34013 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. |
CVE-2022-34011 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. |
CVE-2022-23080 | Medium | 5.0 | 2022-06-22 | In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priv… |
CVE-2021-36761 | Medium | 5.3 | 2022-06-21 | The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF. |
CVE-2022-23071 | Medium | 6.5 | 2022-06-19 | In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters th… |
CVE-2021-41403 | Critical | 9.8 | 2022-06-15 | flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities. |
CVE-2022-29612 | Medium | 4.3 | 2022-06-14 | SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KR… |
CVE-2021-40604 | Critical | 9.1 | 2022-06-13 | A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger d… |
CVE-2022-28217 | Medium | 6.5 | 2022-06-13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary t… |
CVE-2022-24969 | Medium | 6.1 | 2022-06-09 | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can caus… |
CVE-2022-31830 | Critical | 9.1 | 2022-06-09 | Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php. |
CVE-2022-31827 | Critical | 9.1 | 2022-06-09 | MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php. |
CVE-2022-31393 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php. |
CVE-2022-31390 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php. |
CVE-2022-31386 | Critical | 9.1 | 2022-06-09 | A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via inje… |
CVE-2022-27780 | High | 7.5 | 2022-06-02 | The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wron… |
CVE-2021-40186 | Medium | 6.5 | 2022-06-02 | The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulner… |
CVE-2022-1285 | Medium | 6.5 | 2022-06-01 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. |
CVE-2022-1815 | High | 7.5 | 2022-05-25 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
CVE-2022-29309 | High | 7.5 | 2022-05-24 | mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery. |
CVE-2022-28997 | High | 7.5 | 2022-05-23 | CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /adm… |
CVE-2022-29188 | Medium | 5.3 | 2022-05-21 | Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverag… |
CVE-2022-1784 | High | 7.5 | 2022-05-20 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. |
CVE-2022-1767 | High | 7.5 | 2022-05-18 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-28616 | Critical | 9.8 | 2022-05-17 | A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve… |
CVE-2022-24856 | Critical | 9.1 | 2022-05-17 | FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when Fl… |
CVE-2022-1711 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. |
CVE-2022-1723 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-23668 | Medium | 4.9 | 2022-05-16 | A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 an… |
CVE-2022-1722 | Low | 3.3 | 2022-05-16 | SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses |
CVE-2022-1713 | High | 7.5 | 2022-05-16 | SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak… |
CVE-2022-1398 | Medium | 6.5 | 2022-05-16 | The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external med… |
CVE-2022-1386 | Critical | 9.8 | 2022-05-16 | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary… |
CVE-2022-30049 | High | 7.5 | 2022-05-15 | A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl parameter. |
CVE-2022-1379 | Critical | 9.1 | 2022-05-14 | URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the… |
CVE-2020-22983 | High | 8.1 | 2022-05-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a serve… |
CVE-2022-29848 | Medium | 6.5 | 2022-05-11 | In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow the… |
CVE-2022-29847 | High | 7.5 | 2022-05-11 | In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would all… |
CVE-2022-29180 | Medium | 5.9 | 2022-05-07 | A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been… |
CVE-2022-1592 | High | 8.2 | 2022-05-05 | Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requ… |
CVE-2022-29942 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET req… |
CVE-2022-28090 | Medium | 6.5 | 2022-05-04 | Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=. |
CVE-2022-1239 | High | 8.8 | 2022-05-02 | The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capabi… |
CVE-2021-40822 | High | 7.5 | 2022-05-02 | GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host. |
CVE-2022-25850 | High | 7.5 | 2022-05-01 | The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occur… |
CVE-2022-24449 | Critical | 9.8 | 2022-04-28 | Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. |
CVE-2022-29556 | Critical | 9.8 | 2022-04-28 | The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF prim… |
CVE-2022-28117 | Medium | 4.9 | 2022-04-28 | A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests vi… |
CVE-2022-27469 | Critical | 9.8 | 2022-04-26 | Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). |
CVE-2022-27429 | Critical | 9.8 | 2022-04-25 | Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. |
CVE-2022-27311 | Critical | 9.8 | 2022-04-25 | Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. |
CVE-2021-36203 | Medium | 5.3 | 2022-04-22 | The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. |
CVE-2022-24871 | High | 7.2 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server… |
CVE-2022-24862 | High | 7.7 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the d… |
CVE-2022-24825 | Medium | 5.8 | 2022-04-19 | Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks i… |
CVE-2022-29153 | High | 7.5 | 2022-04-19 | HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects re… |
CVE-2022-1037 | High | 7.2 | 2022-04-18 | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local U… |
CVE-2022-27426 | High | 8.8 | 2022-04-15 | A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a cra… |
CVE-2022-26499 | Critical | 9.1 | 2022-04-15 | An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as loc… |
CVE-2022-22339 | High | 7.3 | 2022-04-08 | IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2021-36202 | High | 8.4 | 2022-04-07 | Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF ex… |
CVE-2020-27375 | Medium | 6.5 | 2022-04-07 | Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars. |
CVE-2022-1213 | High | 8.1 | 2022-04-05 | SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary req… |
CVE-2022-1188 | Low | 3.7 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-0990 | Critical | 9.1 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-0939 | Critical | 9.9 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-0425 | Medium | 5.4 | 2022-04-01 | A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side… |
CVE-2022-1191 | High | 8.1 | 2022-03-31 | SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2021-33581 | High | 7.2 | 2022-03-30 | MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the… |
CVE-2022-27907 | Medium | 4.3 | 2022-03-30 | Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. |