Total
774 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-11988 | 2 Apache, Fedoraproject | 2 Xmlgraphics Commons, Fedora | 2022-04-22 | 6.4 MEDIUM | 8.2 HIGH |
| Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later. | |||||
| CVE-2022-22339 | 1 Ibm | 1 Planning Analytics | 2022-04-15 | 6.5 MEDIUM | 7.3 HIGH |
| IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736. | |||||
| CVE-2020-27375 | 1 Drtrustusa | 2 Icheck Connect Bp Monitor Bp Testing 118, Icheck Connect Bp Monitor Bp Testing 118 Firmware | 2022-04-14 | 3.3 LOW | 6.5 MEDIUM |
| Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars. | |||||
| CVE-2021-36202 | 1 Johnsoncontrols | 3 Metasys Application And Data Server, Metasys Extended Application And Data Server, Metasys Open Application Server | 2022-04-14 | 6.5 MEDIUM | 8.8 HIGH |
| Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2. | |||||
| CVE-2022-1213 | 1 Livehelperchat | 1 Live Helper Chat | 2022-04-13 | 5.5 MEDIUM | 8.1 HIGH |
| SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191 | |||||
| CVE-2021-34425 | 5 Apple, Google, Linux and 2 more | 6 Iphone Os, Macos, Android and 3 more | 2022-04-12 | 4.0 MEDIUM | 6.1 MEDIUM |
| The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly. | |||||
| CVE-2022-0425 | 1 Gitlab | 1 Gitlab | 2022-04-12 | 6.5 MEDIUM | 7.6 HIGH |
| A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks. | |||||
| CVE-2022-0990 | 1 Calibre-web Project | 1 Calibre-web | 2022-04-12 | 6.4 MEDIUM | 9.1 CRITICAL |
| Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. | |||||
| CVE-2022-1188 | 1 Gitlab | 1 Gitlab | 2022-04-11 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible. | |||||
| CVE-2022-0939 | 1 Calibre-web Project | 1 Calibre-web | 2022-04-11 | 7.5 HIGH | 9.9 CRITICAL |
| Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. | |||||
| CVE-2022-1191 | 1 Livehelperchat | 1 Live Helper Chat | 2022-04-07 | 5.5 MEDIUM | 8.1 HIGH |
| SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. | |||||
| CVE-2022-27907 | 1 Sonatype | 1 Nexus Repository Manager | 2022-04-07 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. | |||||
| CVE-2021-33581 | 1 Softwareag | 1 Mashzone Nextgen | 2022-04-05 | 6.5 MEDIUM | 7.2 HIGH |
| MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService. | |||||
| CVE-2022-24789 | 1 Orckestra | 1 C1 Cms | 2022-04-05 | 6.5 MEDIUM | 7.6 HIGH |
| C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist. | |||||
| CVE-2022-0249 | 1 Gitlab | 1 Gitlab | 2022-04-04 | 6.4 MEDIUM | 9.1 CRITICAL |
| A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked. | |||||
| CVE-2022-0136 | 1 Gitlab | 1 Gitlab | 2022-04-04 | 5.5 MEDIUM | 8.1 HIGH |
| A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. | |||||
| CVE-2021-29102 | 1 Esri | 1 Arcgis Server | 2022-03-30 | 6.4 MEDIUM | 9.1 CRITICAL |
| A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2020-36232 | 1 Atlassian | 4 Atlassian-gadgets, Data Center, Jira Data Center and 1 more | 2022-03-30 | 4.0 MEDIUM | 5.0 MEDIUM |
| The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled. | |||||
| CVE-2021-44139 | 1 Hashicorp | 1 Sentinel | 2022-03-28 | 5.0 MEDIUM | 7.5 HIGH |
| Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF). | |||||
| CVE-2022-0591 | 1 Subtlewebinc | 1 Formcraft3 | 2022-03-28 | 6.4 MEDIUM | 9.1 CRITICAL |
| The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users | |||||