Total
774 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-7911 | 1 Magento | 1 Magento | 2019-08-08 | 6.5 MEDIUM | 7.2 HIGH |
| A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code. | |||||
| CVE-2019-7913 | 1 Magento | 1 Magento | 2019-08-07 | 6.5 MEDIUM | 7.2 HIGH |
| A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code. | |||||
| CVE-2019-7892 | 1 Magento | 1 Magento | 2019-08-07 | 6.5 MEDIUM | 7.2 HIGH |
| A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery. | |||||
| CVE-2019-7923 | 1 Magento | 1 Magento | 2019-08-07 | 6.5 MEDIUM | 7.2 HIGH |
| A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code. | |||||
| CVE-2019-3905 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2019-07-31 | 7.5 HIGH | 10.0 CRITICAL |
| Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. | |||||
| CVE-2018-1042 | 1 Moodle | 1 Moodle | 2019-07-27 | 4.0 MEDIUM | 6.5 MEDIUM |
| Moodle 3.x has Server Side Request Forgery in the filepicker. | |||||
| CVE-2019-9187 | 1 Ikiwiki | 1 Ikiwiki | 2019-07-17 | 5.0 MEDIUM | 7.5 HIGH |
| ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs. | |||||
| CVE-2018-19495 | 1 Gitlab | 1 Gitlab | 2019-07-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration. | |||||
| CVE-2019-9827 | 1 Hawt | 1 Hawtio | 2019-07-10 | 7.5 HIGH | 9.8 CRITICAL |
| Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI. | |||||
| CVE-2019-12852 | 1 Jetbrains | 1 Youtrack | 2019-07-10 | 7.5 HIGH | 9.8 CRITICAL |
| An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. | |||||
| CVE-2018-14728 | 1 Tecrail | 1 Responsive Filemanager | 2019-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. | |||||
| CVE-2019-12153 | 1 Realobjects | 1 Pdfreactor | 2019-06-17 | 6.4 MEDIUM | 10.0 CRITICAL |
| Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content. | |||||
| CVE-2018-17198 | 1 Apache | 1 Roller | 2019-06-11 | 7.5 HIGH | 9.8 CRITICAL |
| Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: <!-- <servlet-mapping> <servlet-name>XmlRpcServlet</servlet-name> <url-pattern>/roller-services/xmlrpc</url-pattern> </servlet-mapping> --> | |||||
| CVE-2019-9621 | 1 Zimbra | 1 Collaboration Server | 2019-06-06 | 5.0 MEDIUM | 7.5 HIGH |
| Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. | |||||
| CVE-2019-6981 | 1 Synacor | 1 Zimbra Collaboration Suite | 2019-05-30 | 4.0 MEDIUM | 6.5 MEDIUM |
| Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component. | |||||
| CVE-2017-13667 | 1 Open-xchange | 1 Open-xchange Appsuite | 2019-05-28 | 6.5 MEDIUM | 9.9 CRITICAL |
| OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | |||||
| CVE-2017-5643 | 1 Apache | 1 Camel | 2019-05-24 | 5.8 MEDIUM | 7.4 HIGH |
| Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. | |||||
| CVE-2017-15029 | 1 Open-xchange | 1 Open-xchange Appsuite | 2019-05-23 | 4.0 MEDIUM | 4.3 MEDIUM |
| Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | |||||
| CVE-2019-12161 | 1 Webpagetest | 1 Webpagetest | 2019-05-21 | 4.0 MEDIUM | 8.8 HIGH |
| WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). | |||||
| CVE-2019-6512 | 1 Wso2 | 1 Api Manager | 2019-05-14 | 4.0 MEDIUM | 4.1 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper. | |||||