Total
1195 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-8205 | 1 Transloadit | 1 Uppy | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems. | |||||
| CVE-2019-20408 | 1 Atlassian | 1 Jira | 2024-02-28 | 5.0 MEDIUM | 5.3 MEDIUM |
| The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | |||||
| CVE-2020-11980 | 1 Apache | 1 Karaf | 2024-02-28 | 6.5 MEDIUM | 6.3 MEDIUM |
| In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role can call get*. It's possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as "viewer" doesn't have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a "viewer" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as it's possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer. | |||||
| CVE-2020-15152 | 1 Ftp-srv Project | 1 Ftp-srv | 2024-02-28 | 5.0 MEDIUM | 9.1 CRITICAL |
| ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory. | |||||
| CVE-2020-13788 | 1 Linuxfoundation | 1 Harbor | 2024-02-28 | 4.0 MEDIUM | 4.3 MEDIUM |
| Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet. | |||||
| CVE-2020-9645 | 1 Adobe | 1 Experience Manager | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure. | |||||
| CVE-2020-10980 | 1 Gitlab | 1 Gitlab | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration. | |||||
| CVE-2020-14056 | 1 Monstaftp | 1 Monsta Ftp | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services. | |||||
| CVE-2014-8943 | 1 Piwigo | 1 Lexiglot | 2024-02-28 | 6.5 MEDIUM | 8.8 HIGH |
| Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. | |||||
| CVE-2019-11574 | 1 Simplemachines | 1 Simple Machine Forum | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls. | |||||
| CVE-2020-3769 | 1 Adobe | 1 Experience Manager | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure. | |||||
| CVE-2020-8226 | 1 Phpbb | 1 Phpbb | 2024-02-28 | 5.0 MEDIUM | 5.8 MEDIUM |
| A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. | |||||
| CVE-2020-13379 | 4 Fedoraproject, Grafana, Netapp and 1 more | 5 Fedora, Grafana, E-series Performance Analyzer and 2 more | 2024-02-28 | 6.4 MEDIUM | 8.2 HIGH |
| The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. | |||||
| CVE-2020-15879 | 1 Bitwarden | 1 Server | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). | |||||
| CVE-2020-9643 | 1 Adobe | 1 Experience Manager | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure. | |||||
| CVE-2020-4294 | 2 Ibm, Linux | 2 Qradar Security Information And Event Manager, Linux Kernel | 2024-02-28 | 6.5 MEDIUM | 6.3 MEDIUM |
| IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 176404. | |||||
| CVE-2020-14044 | 1 Codiad | 1 Codiad | 2024-02-28 | 6.5 MEDIUM | 7.2 HIGH |
| ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors." | |||||
| CVE-2020-11885 | 1 Wso2 | 1 Enterprise Integrator | 2024-02-28 | 6.5 MEDIUM | 7.2 HIGH |
| WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file. | |||||
| CVE-2020-4101 | 1 Hcltech | 1 Hcl Digital Experience | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| "HCL Digital Experience is susceptible to Server Side Request Forgery." | |||||
| CVE-2020-9298 | 1 Spinnaker | 1 Orca | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure. | |||||