Filtered by CWE-918
Filtered by vendor Subscriptions
Total 1333 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-40809 1 Jamf 1 Jamf 2024-11-21 8.8 High
An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.
CVE-2021-40604 1 Invisioncommunity 1 Ips Community Suite 2024-11-21 9.1 Critical
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
CVE-2021-40537 1 Owncloud 1 User Ldap 2024-11-21 2.7 Low
Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.
CVE-2021-40438 10 Apache, Broadcom, Debian and 7 more 25 Http Server, Brocade Fabric Operating System Firmware, Debian Linux and 22 more 2024-11-21 9.0 Critical
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40186 1 Dnnsoftware 1 Dotnetnuke 2024-11-21 6.5 Medium
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the firewall and access sensitive information from Cloud Provider metadata services.
CVE-2021-40109 1 Concretecms 1 Concrete Cms 2024-11-21 6.4 Medium
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded.
CVE-2021-40091 1 Squaredup 1 Squaredup 2024-11-21 9.8 Critical
An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.
CVE-2021-3959 1 Bitdefender 1 Gravityzone 2024-11-21 6.8 Medium
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3.8.272
CVE-2021-3758 1 Bookstackapp 1 Bookstack 2024-11-21 6.5 Medium
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2021-3553 1 Bitdefender 2 Endpoint Security Tools, Gravityzone 2024-11-21 5.3 Medium
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
CVE-2021-3552 1 Bitdefender 2 Endpoint Security Tools, Gravityzone 2024-11-21 5.3 Medium
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.
CVE-2021-3204 1 Webware 1 Webdesktop 2024-11-21 6.5 Medium
SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.
CVE-2021-39935 1 Gitlab 1 Gitlab 2024-11-21 6.8 Medium
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CVE-2021-39927 1 Gitlab 1 Gitlab 2024-11-21 3.5 Low
Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443
CVE-2021-39894 1 Gitlab 1 Gitlab 2024-11-21 5.4 Medium
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
CVE-2021-39867 1 Gitlab 1 Gitlab 2024-11-21 6.5 Medium
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.
CVE-2021-39497 1 Eyoucms 1 Eyoucms 2024-11-21 9.8 Critical
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.
CVE-2021-39339 1 Telefication 1 Telefication 2024-11-21 5.8 Medium
The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0.
CVE-2021-39303 1 Jamf 1 Jamf 2024-11-21 9.8 Critical
The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability.
CVE-2021-39195 1 Misskey 1 Misskey 2024-11-21 7.7 High
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.