Filtered by CWE-918
Filtered by vendor Subscriptions
Total 1317 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-15644 1 Webmin 1 Webmin 2024-11-21 N/A
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.
CVE-2017-15029 1 Open-xchange 1 Open-xchange Appsuite 2024-11-21 N/A
Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2017-14611 1 Agentejo 1 Cockpit 2024-11-21 N/A
SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component.
CVE-2017-14585 1 Atlassian 2 Hipchat Data Center, Hipchat Server 2024-11-21 N/A
A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.
CVE-2017-14323 1 Onethink 1 Onethink 2024-11-21 N/A
SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter.
CVE-2017-13667 1 Open-xchange 1 Open-xchange Appsuite 2024-11-21 N/A
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2017-12905 1 Vebto 1 Pixie - Image Editor 2024-11-21 10.0 Critical
Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.
CVE-2017-12071 1 Synology 1 Photo Station 2024-11-21 N/A
Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
CVE-2017-11291 1 Adobe 1 Connect 2024-11-21 N/A
An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery (SSRF) vulnerability exists that could be abused to bypass network access controls.
CVE-2017-11149 1 Synology 1 Download Station 2024-11-21 N/A
Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.
CVE-2017-11148 1 Synology 1 Chat 2024-11-21 N/A
Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors.
CVE-2017-10973 1 Finecms Project 1 Finecms 2024-11-21 N/A
In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP Host header.
CVE-2017-1000419 1 Phpbb 1 Phpbb 2024-11-21 N/A
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
CVE-2017-1000237 1 I-librarian 1 I Librarian 2024-11-21 N/A
I, Librarian version <=4.6 & 4.7 is vulnerable to Server-Side Request Forgery in the ajaxsupplement.php resulting in the attacker being able to reset any user's password.
CVE-2017-1000139 1 Mahara 1 Mahara 2024-11-21 N/A
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
CVE-2017-1000017 1 Phpmyadmin 1 Phpmyadmin 2024-11-21 N/A
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
CVE-2017-0929 1 Dnnsoftware 1 Dotnetnuke 2024-11-21 N/A
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
CVE-2017-0907 1 Recurly 1 Recurly Client .net 2024-11-21 N/A
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
CVE-2017-0906 1 Recurly 1 Recurly Client Python 2024-11-21 N/A
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
CVE-2017-0905 1 Recurly 1 Recurly Client Ruby 2024-11-21 N/A
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.