Total
1056 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-24150 | 1 Likebtn-like-button Project | 1 Likebtn-like-button | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| The LikeBtn WordPress Like Button Rating ? LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF). | |||||
| CVE-2021-31779 | 1 Yoast | 1 Yoast Seo | 2023-12-10 | 5.5 MEDIUM | 6.4 MEDIUM |
| The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account. | |||||
| CVE-2020-14327 | 1 Redhat | 1 Ansible Tower | 2023-12-10 | 2.1 LOW | 5.5 MEDIUM |
| A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response. | |||||
| CVE-2021-32698 | 1 Elabftw | 1 Elabftw | 2023-12-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0. | |||||
| CVE-2020-15377 | 1 Broadcom | 1 Sannav | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF). | |||||
| CVE-2021-33213 | 1 Element-it | 1 Http Commander | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address. | |||||
| CVE-2021-28060 | 1 Group-office | 1 Group Office | 2023-12-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php. | |||||
| CVE-2021-39497 | 1 Eyoucms | 1 Eyoucms | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function. | |||||
| CVE-2021-33571 | 2 Djangoproject, Fedoraproject | 2 Django, Fedora | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) . | |||||
| CVE-2020-14328 | 1 Redhat | 1 Ansible Tower | 2023-12-10 | 2.1 LOW | 3.3 LOW |
| A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality. | |||||
| CVE-2021-31950 | 1 Microsoft | 2 Sharepoint Foundation, Sharepoint Server | 2023-12-10 | 5.5 MEDIUM | 7.6 HIGH |
| Microsoft SharePoint Server Spoofing Vulnerability | |||||
| CVE-2021-37353 | 1 Nagios | 1 Nagios Xi Docker Wizard | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php. | |||||
| CVE-2021-24472 | 1 Qantumthemes | 2 Kentharadio, Onair2 | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website. | |||||
| CVE-2020-28043 | 1 Misp | 1 Misp | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. | |||||
| CVE-2021-22179 | 1 Gitlab | 1 Gitlab | 2023-12-10 | 5.5 MEDIUM | 5.4 MEDIUM |
| A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature. | |||||
| CVE-2020-15822 | 1 Jetbrains | 1 Youtrack | 2023-12-10 | 7.5 HIGH | 7.3 HIGH |
| In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. | |||||
| CVE-2021-23927 | 1 Open-xchange | 1 Open-xchange Appsuite | 2023-12-10 | 5.5 MEDIUM | 6.4 MEDIUM |
| OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. | |||||
| CVE-2020-28735 | 1 Plone | 1 Plone | 2023-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). | |||||
| CVE-2021-21288 | 1 Carrierwave Project | 1 Carrierwave | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1. | |||||
| CVE-2020-5784 | 1 Teltonika-networks | 2 Trb245, Trb245 Firmware | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs. | |||||