Export limit exceeded: 384637 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4470 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-25876 | 1 Link-preview-js Project | 1 Link-preview-js | 2024-11-21 | 6.2 Medium |
| The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection. | ||||
| CVE-2022-25850 | 1 Proxyscotch Project | 1 Proxyscotch | 2024-11-21 | 7.5 High |
| The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server. | ||||
| CVE-2022-25801 | 1 Bestpractical | 1 Request Tracker For Incident Response | 2024-11-21 | 9.1 Critical |
| Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. | ||||
| CVE-2022-25800 | 1 Bestpractical | 1 Request Tracker For Incident Response | 2024-11-21 | 9.1 Critical |
| Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. | ||||
| CVE-2022-25355 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.3 Medium |
| EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users. | ||||
| CVE-2022-25265 | 3 Linux, Netapp, Redhat | 20 Linux Kernel, Baseboard Management Controller Firmware, H300e and 17 more | 2024-11-21 | 7.8 High |
| In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file. | ||||
| CVE-2022-25260 | 1 Jetbrains | 1 Hub | 2024-11-21 | 9.1 Critical |
| JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). | ||||
| CVE-2022-24980 | 1 Kitodo | 1 Kitodo.presentation | 2024-11-21 | 7.5 High |
| An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to. | ||||
| CVE-2022-24969 | 1 Apache | 1 Dubbo | 2024-11-21 | 6.1 Medium |
| bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability. | ||||
| CVE-2022-24568 | 1 Xxyopen | 1 Novel-plus | 2024-11-21 | 9.8 Critical |
| Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. | ||||
| CVE-2022-24449 | 1 Rt-solar | 1 Solar Appscreener | 2024-11-21 | 9.8 Critical |
| Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. | ||||
| CVE-2022-24333 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 6.5 Medium |
| In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. | ||||
| CVE-2022-24129 | 1 Shibboleth | 1 Oidc Op | 2024-11-21 | 8.2 High |
| The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services. | ||||
| CVE-2022-24041 | 1 Siemens | 8 Desigo Dxr2, Desigo Dxr2 Firmware, Desigo Pxc3 and 5 more | 2024-11-21 | 6.5 Medium |
| A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application stores the PBKDF2 derived key of users passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plaintext passwords of other users. | ||||
| CVE-2022-23668 | 1 Arubanetworks | 1 Clearpass Policy Manager | 2024-11-21 | 4.9 Medium |
| A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manage that address this security vulnerability. | ||||
| CVE-2022-23348 | 1 Bigantsoft | 1 Bigant Server | 2024-11-21 | 5.3 Medium |
| BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. | ||||
| CVE-2022-23206 | 1 Apache | 1 Traffic Control | 2024-11-21 | 7.5 High |
| In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach. | ||||
| CVE-2022-23080 | 1 Rangerstudio | 1 Directus | 2024-11-21 | 5.0 Medium |
| In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans. | ||||
| CVE-2022-23071 | 1 Tandoor | 1 Recipes | 2024-11-21 | 6.5 Medium |
| In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information. | ||||
| CVE-2022-22993 | 1 Westerndigital | 11 My Cloud, My Cloud Dl2100, My Cloud Dl4100 and 8 more | 2024-11-21 | 7.8 High |
| A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters. | ||||