CWE:

	Tytuł	Data	Autor
Low	SAP Enterprise Portal iviewCatcherEditor Server-Side Request Forgery	27.01.2022	Yvan Genuer
Med.	OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting	17.07.2021	Martin Heiland
Med.	Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery	17.09.2020	Julien Ahrens
Low	OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation	16.06.2020	Martin Heiland
High	Fortify SSC 17.10 / 17.20 / 18.10 XXE Injection	14.07.2018	Alt3kx
Low	SPIP 3.1.2 Server Side Request Forgery	20.10.2016	Nicolas CHATELAIN
Low	Google Docs XSPA / SSRF	10.09.2016	Ashiyane Digital Secur...
Low	Infoware MapSuite Server-Side Request Forgery	04.06.2014	Christian

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2023-01-13

CVE-2023-22493

Updating...

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.

2022-12-31

CVE-2017-20157

Updating...

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

2022-12-29

	CVE-2022-38203	Updating...	Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
	CVE-2022-38211	Updating...	Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
	CVE-2022-38212	Updating...	Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.

2022-12-27

CVE-2022-4725

Updating...

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.

2022-12-21

CVE-2022-3189

Updating...

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter.

2022-12-16

CVE-2022-42343

Updating...

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

2022-12-14

CVE-2022-3590

Updating...

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

2022-12-13

CVE-2022-46364

Updating...

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

 

---

Copyright 2023, cxsecurity.com