CWE-918 Archives - CVE Vulnerability

CVE-2007-6758

Sun, 26 Feb 2023 09:08:20 +0000

Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.

The post CVE-2007-6758 appeared first on CVE Vulnerability.

CVE-2018-9919

Sun, 26 Feb 2023 06:51:52 +0000

A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution, because /vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php writes data from the “down_url” URL into the “bddlj” local file if the attacker knows the backdoor “jmmy” parameter.

The post CVE-2018-9919 appeared first on CVE Vulnerability.

CVE-2018-9920

Sun, 26 Feb 2023 06:51:52 +0000

Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.

The post CVE-2018-9920 appeared first on CVE Vulnerability.

CVE-2018-9302

Sun, 26 Feb 2023 06:51:47 +0000

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.

The post CVE-2018-9302 appeared first on CVE Vulnerability.

CVE-2018-8939

Sun, 26 Feb 2023 06:51:40 +0000

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can submit specially crafted requests via the NmAPI executable to (1) gain unauthorized access to the WhatsUp Gold system, (2) obtain information about the WhatsUp Gold system, or (3) execute remote commands.

The post CVE-2018-8939 appeared first on CVE Vulnerability.

CVE-2018-8801

Sun, 26 Feb 2023 06:51:36 +0000

GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.

The post CVE-2018-8801 appeared first on CVE Vulnerability.

CVE-2018-7667

Sun, 26 Feb 2023 06:51:07 +0000

Adminer through 4.3.1 has SSRF via the server parameter.

The post CVE-2018-7667 appeared first on CVE Vulnerability.

CVE-2018-7516

Sun, 26 Feb 2023 06:51:04 +0000

A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could lead to proxied network scans.

The post CVE-2018-7516 appeared first on CVE Vulnerability.

CVE-2018-7055

Sun, 26 Feb 2023 06:50:55 +0000

GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.

The post CVE-2018-7055 appeared first on CVE Vulnerability.

CVE-2018-6186

Sun, 26 Feb 2023 06:50:37 +0000

Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges.

The post CVE-2018-6186 appeared first on CVE Vulnerability.