Filtered by CWE-918
Filtered by vendor Subscriptions
Total 1407 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-33571 3 Djangoproject, Fedoraproject, Redhat 5 Django, Fedora, Openstack and 2 more 2024-11-21 7.5 High
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
CVE-2021-33511 1 Plone 1 Plone 2024-11-21 7.5 High
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
CVE-2021-33510 1 Plone 1 Plone 2024-11-21 4.3 Medium
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
CVE-2021-33213 1 Element-it 1 Http Commander 2024-11-21 6.5 Medium
An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
CVE-2021-33184 1 Synology 1 Download Station 2024-11-21 7.7 High
Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2021-33181 1 Synology 1 Video Station 2024-11-21 6.6 Medium
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
CVE-2021-32698 1 Elabftw 1 Elabftw 2024-11-21 6.8 Medium
eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.
CVE-2021-32682 1 Std42 1 Elfinder 2024-11-21 9.8 Critical
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
CVE-2021-32663 1 Combodo 1 Itop 2024-11-21 8.7 High
iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
CVE-2021-32639 1 Nsa 1 Emissary 2024-11-21 7.2 High
Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.
CVE-2021-32603 1 Fortinet 2 Fortianalyzer, Fortimanager 2024-11-21 8.8 High
A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker to access unauthorized files and services on the system via specifically crafted web requests.
CVE-2021-31950 1 Microsoft 2 Sharepoint Foundation, Sharepoint Server 2024-11-21 7.6 High
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-31910 1 Jetbrains 1 Teamcity 2024-11-21 7.5 High
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
CVE-2021-31828 1 Amazon 1 Open Distro 2024-11-21 7.1 High
An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope.
CVE-2021-31779 1 Yoast 1 Yoast Seo 2024-11-21 6.4 Medium
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
CVE-2021-31531 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2024-11-21 9.8 Critical
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2021-31216 1 Siren 1 Investigate 2024-11-21 8.1 High
Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.
CVE-2021-30108 1 Feehi 1 Feehi Cms 2024-11-21 9.1 Critical
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
CVE-2021-29863 2 Ibm, Linux 2 Qradar Security Information And Event Manager, Linux Kernel 2024-11-21 4.3 Medium
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.
CVE-2021-29844 1 Ibm 7 Engineering Lifecycle Optimization, Engineering Requirements Quality Assistant On-premises, Engineering Workflow Management and 4 more 2024-11-21 8.8 High
IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.