CWE:

	Tytuł	Data	Autor
Med.	Desktop Central 9.1.0 CRLF Injection / Server-Side Request Forgery	27.03.2023	Rafael Pedrero
Low	SAP Enterprise Portal iviewCatcherEditor Server-Side Request Forgery	27.01.2022	Yvan Genuer
Med.	OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting	17.07.2021	Martin Heiland
Med.	Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery	17.09.2020	Julien Ahrens
Low	OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation	16.06.2020	Martin Heiland
High	Fortify SSC 17.10 / 17.20 / 18.10 XXE Injection	14.07.2018	Alt3kx
Low	SPIP 3.1.2 Server Side Request Forgery	20.10.2016	Nicolas CHATELAIN
Low	Google Docs XSPA / SSRF	10.09.2016	Ashiyane Digital Secur...
Low	Infoware MapSuite Server-Side Request Forgery	04.06.2014	Christian

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-10-17

CVE-2024-49312

Updating...

Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.7.

2024-10-16

CVE-2012-10018

Updating...

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.

2024-10-11

CVE-2024-45317

Updating...

A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address.

2024-10-10

CVE-2024-45119

Updating...

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs and have a low impact on both confidentiality and integrity. Exploitation of this issue does not require user interaction and scope is changed.

2024-10-07

CVE-2024-45290

Updating...

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

2024-09-23

	CVE-2024-47066	Updating...	Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.
	CVE-2024-43989	Updating...	Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid allows Server Side Request Forgery.This issue affects Justified Image Grid: from n/a through 4.6.1.

2024-09-17

CVE-2024-38183

Updating...

An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.

2024-09-13

CVE-2024-6587

Updating...

A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.

2024-08-13

CVE-2024-7740

Updating...

A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

 

---

Copyright 2024, cxsecurity.com