CWE-918 · Server-Side Request Forgery (SSRF) (page 27)
Page 27 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24789 | High | 7.6 | 2022-03-28 | C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery… |
CVE-2022-0249 | Low | 3.1 | 2022-03-28 | A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not… |
CVE-2022-0136 | Medium | 5.4 | 2022-03-28 | A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the… |
CVE-2021-44139 | High | 7.5 | 2022-03-23 | Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF). |
CVE-2022-0591 | Critical | 9.1 | 2022-03-21 | The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unaut… |
CVE-2022-27245 | High | 8.8 | 2022-03-18 | An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF. |
CVE-2021-45968 | High | 7.5 | 2022-03-18 | An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other p… |
CVE-2021-46107 | High | 7.5 | 2022-03-17 | Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the downloa… |
CVE-2021-45851 | High | 7.5 | 2022-03-16 | A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal envir… |
CVE-2021-39051 | Medium | 6.5 | 2022-03-14 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registr… |
CVE-2021-43954 | Medium | 4.3 | 2022-03-14 | The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enu… |
CVE-2022-0870 | Medium | 5.3 | 2022-03-11 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2018-25031 | Medium | 4.3 | 2022-03-11 | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit… |
CVE-2022-24739 | High | 7.3 | 2022-03-08 | alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack… |
CVE-2022-0767 | Critical | 9.9 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0766 | Critical | 9.8 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0528 | Medium | 6.5 | 2022-03-03 | Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1. |
CVE-2022-0768 | Critical | 9.1 | 2022-02-28 | Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2. |
CVE-2022-25260 | Critical | 9.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). |
CVE-2022-24333 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. |
CVE-2022-24980 | High | 7.5 | 2022-02-19 | An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check… |
CVE-2022-21215 | Critical | 10.0 | 2022-02-18 | This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to… |
CVE-2022-0671 | Critical | 9.1 | 2022-02-18 | A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file. |
CVE-2021-20325 | Critical | 9.8 | 2022-02-18 | Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compar… |
CVE-2022-23644 | High | 8.8 | 2022-02-16 | BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server… |
CVE-2022-24568 | Critical | 9.8 | 2022-02-10 | Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. |
CVE-2021-25939 | Low | 2.7 | 2022-02-09 | In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not… |
CVE-2021-45325 | High | 7.5 | 2022-02-08 | Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. |
CVE-2022-0508 | Medium | 5.3 | 2022-02-08 | Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832 |
CVE-2022-23206 | High | 7.5 | 2022-02-06 | In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST requ… |
CVE-2022-24129 | High | 8.2 | 2022-02-04 | The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri p… |
CVE-2021-42637 | Critical | 9.8 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerabili… |
CVE-2022-0339 | Critical | 9.8 | 2022-01-30 | Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. |
CVE-2022-22993 | High | 7.8 | 2022-01-28 | A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the… |
CVE-2021-22821 | High | 8.6 | 2022-01-28 | A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets whe… |
CVE-2022-21697 | Medium | 6.3 | 2022-01-25 | Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Sid… |
CVE-2021-36349 | Medium | 4.3 | 2022-01-24 | Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicio… |
CVE-2021-23664 | High | 8.6 | 2022-01-21 | The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redi… |
CVE-2021-41809 | Low | 3.5 | 2022-01-18 | SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain docu… |
CVE-2021-39927 | Low | 3.5 | 2022-01-18 | Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to… |
CVE-2021-45394 | High | 8.8 | 2022-01-18 | An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in… |
CVE-2022-22702 | Medium | 4.3 | 2022-01-10 | PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to loc… |
CVE-2022-0132 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-27738 | High | 7.5 | 2022-01-06 | All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security che… |
CVE-2022-0086 | Critical | 9.8 | 2022-01-04 | uppy is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-44659 | Critical | 9.8 | 2021-12-22 | Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Requ… |
CVE-2021-22056 | High | 7.5 | 2021-12-20 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with netw… |
CVE-2021-22054 | High | 7.5 | 2021-12-17 | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SS… |
CVE-2021-3959 | Medium | 6.8 | 2021-12-16 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy request… |
CVE-2021-34425 | Medium | 4.7 | 2021-12-14 | The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat… |
CVE-2021-39057 | High | 8.1 | 2021-12-13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unaut… |
CVE-2021-39935 | Medium | 6.8 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-37940 | Medium | 6.8 | 2021-12-07 | An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integrati… |
CVE-2021-4075 | High | 7.2 | 2021-12-06 | snipe-it is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-40091 | Critical | 9.8 | 2021-12-06 | An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654. |
CVE-2021-29863 | Medium | 4.3 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from th… |
CVE-2021-40809 | High | 8.8 | 2021-12-01 | An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses speci… |
CVE-2021-36327 | Medium | 5.3 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exp… |
CVE-2021-43296 | High | 7.5 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor. |
CVE-2021-22049 | Critical | 9.8 | 2021-11-24 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor wi… |
CVE-2021-43780 | Medium | 6.8 | 2021-11-24 | Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is… |
CVE-2021-3553 | Medium | 5.3 | 2021-11-24 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protec… |
CVE-2021-3552 | Medium | 5.3 | 2021-11-24 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy request… |
CVE-2021-23718 | Medium | 6.5 | 2021-11-22 | The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if th… |
CVE-2021-22970 | High | 7.5 | 2021-11-19 | Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on… |
CVE-2021-22969 | Medium | 5.3 | 2021-11-19 | Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS… |
CVE-2021-39303 | Critical | 9.8 | 2021-11-12 | The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability. |
CVE-2021-43562 | High | 8.8 | 2021-11-10 | An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to… |
CVE-2021-43293 | Medium | 4.3 | 2021-11-04 | Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request F… |
CVE-2021-29738 | Medium | 5.4 | 2021-11-02 | IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF). This may allow an authenticate… |
CVE-2021-29844 | High | 8.8 | 2021-10-27 | IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from… |
CVE-2021-35512 | Medium | 6.5 | 2021-10-21 | An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. |
CVE-2021-41792 | Medium | 5.3 | 2021-10-21 | An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted H… |
CVE-2021-25972 | Medium | 4.9 | 2021-10-20 | In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch… |
CVE-2021-32663 | High | 8.7 | 2021-10-19 | iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific… |
CVE-2021-22033 | Low | 2.7 | 2021-10-13 | Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability. |
CVE-2021-42091 | Critical | 9.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. |
CVE-2021-22958 | Critical | 9.8 | 2021-10-07 | A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in plac… |
CVE-2020-21653 | Critical | 9.1 | 2021-10-06 | Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sj() method. |
CVE-2020-21649 | High | 8.1 | 2021-10-06 | Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sql() method. |
CVE-2021-39894 | Medium | 5.4 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Si… |
CVE-2021-39867 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Requ… |
CVE-2021-37223 | Medium | 6.5 | 2021-10-05 | Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create sched… |
CVE-2021-37104 | High | 7.5 | 2021-09-28 | There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability is due to insufficient validation of pa… |
CVE-2021-40109 | Medium | 6.4 | 2021-09-27 | A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files fro… |
CVE-2021-41385 | Medium | 6.5 | 2021-09-27 | The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details… |
CVE-2021-41587 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources. |
CVE-2021-41586 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password. |
CVE-2020-24327 | Medium | 5.3 | 2021-09-23 | Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload p… |
CVE-2021-21993 | Medium | 6.5 | 2021-09-23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An author… |
CVE-2021-39339 | Medium | 5.8 | 2021-09-22 | The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request valu… |
CVE-2021-41084 | High | 8.7 | 2021-09-21 | http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted… |
CVE-2021-37419 | High | 7.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. |
CVE-2021-40438 | Critical | 9.0 | 2021-09-16 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4… |
CVE-2021-33705 | High | 8.1 | 2021-09-15 | The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerabil… |
CVE-2021-33690 | Critical | 9.9 | 2021-09-15 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2… |
CVE-2020-21122 | Medium | 5.3 | 2021-09-15 | UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports. |
CVE-2021-23029 | High | 8.8 | 2021-09-14 | On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (S… |
CVE-2021-28910 | High | 7.5 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and extern… |
CVE-2021-40537 | Low | 2.7 | 2021-09-08 | Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary f… |