Browse CVEs

MEDIUM 6.5 CVE-2022-29188 Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attacke… Smokescreen 0.0.4+ Fix from $1,6002022-05-21 HIGH 7.5 CVE-2022-1784 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. Drawio 18.0.8+ Fix from $1,9502022-05-20 HIGH 7.5 CVE-2022-1767 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. Drawio 18.0.7+ Fix from $1,9502022-05-18 CRITICAL 9.8 CVE-2022-28616 A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update … Oneview 7.0+ Fix from $2,3002022-05-17 HIGH 7.5 CVE-2022-24856EPSS 10% FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSR… Flyte Console 0.52.0+ Fix from $1,9502022-05-17 HIGH 7.5 CVE-2022-1711EPSS 6% Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. Drawio 18.0.5+ Fix from $1,9502022-05-17 HIGH 7.5 CVE-2022-1723 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. Drawio 18.0.6+ Fix from $1,9502022-05-17 HIGH 7.5 CVE-2022-1713EPSS 10% SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead … Drawio 18.0.4+ Fix from $1,9502022-05-16 CRITICAL 9.8 CVE-2022-1386EPSS 72% The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate… Fusion Builder 3.6.2 / 7.6.2+ Fix from $2,3002022-05-16 MEDIUM 6.5 CVE-2022-1398 The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are ex… External Media Without Import after 1.1.2 Fix from $1,6002022-05-16 HIGH 7.5 CVE-2022-30049 A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl p… Rebuild No fix yet Fix from $1,9502022-05-15 CRITICAL 9.1 CVE-2022-1379 URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are impo… Fedora 1.2022.5+ Fix from $2,3002022-05-14 HIGH 8.1 CVE-2020-22983 A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to condu… Microstrategy Web after 11.1 Fix from $1,9502022-05-13 HIGH 7.5 CVE-2022-29847EPSS 57% In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that… Whatsup Gold after 21.1.1 Fix from $1,9502022-05-11 MEDIUM 6.5 CVE-2022-29848 In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would… Whatsup Gold after 21.1.1 Fix from $1,6002022-05-11 CRITICAL 9.8 CVE-2022-29180 A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. Thi… Charm 0.12.1+ Fix from $2,3002022-05-07 HIGH 8.2 CVE-2022-1592 Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbi… Scout 4.42+ Fix from $1,9502022-05-05 MEDIUM 6.5 CVE-2022-29942 Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HT… Administration Center Mitigation only Fix from $1,6002022-05-04 MEDIUM 6.5 CVE-2022-28090 Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=. Jspxcms No fix yet Fix from $1,6002022-05-04 HIGH 8.8 CVE-2022-1239 The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_po… Hubspot 8.8.15+ Fix from $1,9502022-05-02 HIGH 7.5 CVE-2021-40822EPSS 19% GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host. Geoserver 2.19.3+ Fix from $1,9502022-05-02 HIGH 7.5 CVE-2022-25850 The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy… Proxyscotch 1.0.0+ Fix from $1,9502022-05-01 CRITICAL 9.8 CVE-2022-24449 Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. Solar Appscreener after 3.10.4 Fix from $2,3002022-04-28 CRITICAL 9.8 CVE-2022-29556 The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several… Mender Mitigation only Fix from $2,3002022-04-28 CRITICAL 9.8 CVE-2022-27469 Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). Monsta Ftp No fix yet Fix from $2,3002022-04-26 CRITICAL 9.8 CVE-2022-27311 Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. Gibbon 3.4.4+ Fix from $2,3002022-04-25 CRITICAL 9.8 CVE-2022-27429 Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. Jizhicms No fix yet Fix from $2,3002022-04-25 CRITICAL 9.1 CVE-2021-36203 The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. Metasys System Configuration Tool 14.2.2+ Fix from $2,3002022-04-22 MEDIUM 5.5 CVE-2022-24871 Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on t… Shopware 6.4.10.1+ Fix from $1,6002022-04-20 HIGH 7.7 CVE-2022-24862 Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. Du… Databasir No fix yet Fix from $1,9502022-04-20