Total
1279 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-18638 | 1 Graphite Project | 1 Graphite | 2024-08-05 | 7.5 High |
| send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. | ||||
| CVE-2017-16870 | 1 Updraftplus | 1 Updraftplus | 2024-08-05 | N/A |
| The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary | ||||
| CVE-2017-17674 | 1 Bmc | 1 Remedy Mid-tier | 2024-08-05 | 9.8 Critical |
| BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE). | ||||
| CVE-2017-17697 | 1 Linuxfoundation | 1 Harbor | 2024-08-05 | 8.6 High |
| The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping. | ||||
| CVE-2017-16614 | 1 Tp-shop | 1 Tpshop | 2024-08-05 | N/A |
| SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php fBill parameter. | ||||
| CVE-2017-15943 | 1 Paloaltonetworks | 1 Pan-os | 2024-08-05 | N/A |
| The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities. | ||||
| CVE-2017-15029 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-08-05 | N/A |
| Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | ||||
| CVE-2017-14611 | 1 Agentejo | 1 Cockpit | 2024-08-05 | N/A |
| SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component. | ||||
| CVE-2017-14323 | 1 Onethink | 1 Onethink | 2024-08-05 | N/A |
| SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter. | ||||
| CVE-2017-13667 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-08-05 | N/A |
| OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | ||||
| CVE-2017-12905 | 1 Vebto | 1 Pixie - Image Editor | 2024-08-05 | 10.0 Critical |
| Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php. | ||||
| CVE-2017-11291 | 1 Adobe | 1 Connect | 2024-08-05 | N/A |
| An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery (SSRF) vulnerability exists that could be abused to bypass network access controls. | ||||
| CVE-2017-10973 | 1 Finecms Project | 1 Finecms | 2024-08-05 | N/A |
| In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP Host header. | ||||
| CVE-2024-27927 | 2024-08-05 | 6.5 Medium | ||
| RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request. | ||||
| CVE-2017-9458 | 1 Paloaltonetworks | 1 Pan-os | 2024-08-05 | N/A |
| XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause a denial of service, or conduct server-side request forgery (SSRF) attacks via unspecified vectors. | ||||
| CVE-2017-9355 | 1 Subsonic | 1 Subsonic | 2024-08-05 | N/A |
| XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file. | ||||
| CVE-2017-9307 | 1 Allen Disk Project | 1 Allen Disk | 2024-08-05 | N/A |
| SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter. | ||||
| CVE-2017-9066 | 2 Debian, Wordpress | 2 Debian Linux, Wordpress | 2024-08-05 | N/A |
| In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | ||||
| CVE-2017-8794 | 1 Accellion | 1 File Transfer Appliance | 2024-08-05 | N/A |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern. | ||||
| CVE-2017-7553 | 1 Redhat | 1 Mobile Application Platform | 2024-08-05 | N/A |
| The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints. | ||||