Vulnerabilities (CVE)

Filtered by CWE-918
Total 1243 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-7272 1 Php 1 Php 2024-02-28 5.8 MEDIUM 7.4 HIGH
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2017-8794 1 Accellion 1 File Transfer Appliance 2024-02-28 6.4 MEDIUM 10.0 CRITICAL
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.
CVE-2015-7570 1 Yeager 1 Yeager Cms 2024-02-28 6.4 MEDIUM 7.2 HIGH
Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php, libs/org/adodb_lite/tests/test_datadictionary.php, or libs/org/adodb_lite/tests/test_adodb_lite_sessions.php.
CVE-2015-8813 1 Umbraco 1 Umbraco 2024-02-28 4.3 MEDIUM 8.2 HIGH
The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
CVE-2016-9417 1 Mybb 2 Merge System, Mybb 2024-02-28 5.8 MEDIUM 7.4 HIGH
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVE-2017-7200 1 Openstack 1 Glance 2024-02-28 5.0 MEDIUM 5.8 MEDIUM
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
CVE-2017-6130 1 F5 2 Ssl Intercept Iapp, Ssl Orchestrator 2024-02-28 5.8 MEDIUM 7.4 HIGH
F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic.
CVE-2017-5643 1 Apache 1 Camel 2024-02-28 5.8 MEDIUM 7.4 HIGH
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
CVE-2016-9752 1 S9y 1 Serendipity 2024-02-28 5.0 MEDIUM 8.6 HIGH
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
CVE-2016-7999 1 Spip 1 Spip 2024-02-28 4.3 MEDIUM 7.4 HIGH
ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.
CVE-2016-6621 1 Phpmyadmin 1 Phpmyadmin 2024-02-28 5.0 MEDIUM 8.6 HIGH
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVE-2016-4046 1 Open-xchange 1 Open-xchange Appsuite 2024-02-28 5.0 MEDIUM 5.8 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.
CVE-2017-3546 1 Oracle 1 Peoplesoft Enterprise Peopletools 2024-02-28 6.4 MEDIUM 6.5 MEDIUM
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2016-7051 1 Fasterxml 1 Jackson-dataformat-xml 2024-02-28 5.0 MEDIUM 8.6 HIGH
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
CVE-2017-9066 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-02-28 5.0 MEDIUM 8.6 HIGH
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
CVE-2016-4374 1 Hp 1 Release Control 2024-02-28 4.0 MEDIUM 7.7 HIGH
HPE Release Control (RC) 9.13, 9.20, and 9.21 before 9.21.0005 p4 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and consequently obtain sensitive information or cause a denial of service, via unspecified vectors.
CVE-2016-4029 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-02-28 5.0 MEDIUM 8.6 HIGH
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
CVE-2016-7964 1 Dokuwiki 1 Dokuwiki 2024-02-28 4.3 MEDIUM 8.6 HIGH
The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.
CVE-2016-6483 1 Vbulletin 1 Vbulletin 2024-02-28 5.0 MEDIUM 8.6 HIGH
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
CVE-2024-1965 2024-02-28 N/A 6.5 MEDIUM
Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.