KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restric…

CVE-2022-40146HIGHCVSS 7.5EG 7.5

2022-09-22

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

CVE-2022-40296CRITICALCVSS 9.8EG 9.8

2022-10-31

The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.…

CVE-2022-40305CRITICALCVSS 9.8EG 9.8

2022-09-09

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login…

CVE-2022-40312MEDIUMCVSS 5.5EG 5.5

2023-12-18

Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.

CVE-2022-40357CRITICALCVSS 9.8EG 9.8

2022-09-20

A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary request…

CVE-2022-40700HIGHCVSS 8.2EG 8.2

2024-01-19

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommer…

CVE-2022-40842CRITICALCVSS 9.1EG 9.1

2022-11-22

ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.

CVE-2022-4096MEDIUMCVSS 6.5EG 6.5

2022-11-21

Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.

CVE-2022-41040HIGHCVSS 8.8EG 9.0⚠ KEV

2022-10-03

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-41401MEDIUMCVSS 6.5EG 6.5

2023-08-04

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.

CVE-2022-41412HIGHCVSS 8.6EG 9.0

2022-11-30

An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.

CVE-2022-41477CRITICALCVSS 9.1EG 9.1

2022-10-14

A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories.

CVE-2022-41495CRITICALCVSS 9.8EG 9.8

2022-10-13

ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.

CVE-2022-41496CRITICALCVSS 9.8EG 9.8

2022-10-13

iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.

CVE-2022-41497CRITICALCVSS 9.8EG 9.8

2022-10-13

ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.

CVE-2022-41552CRITICALCVSS 9.8EG 9.8

2022-11-01

Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer detail view, Hitac…

CVE-2022-41609MEDIUMCVSS 6.4EG 8.8

2022-11-19

Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.

CVE-2022-41704HIGHCVSS 7.5EG 7.5

2022-10-25

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

CVE-2022-41906HIGHCVSS 8.7EG 8.7

2022-11-11

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin star…

CVE-2022-41949MEDIUMCVSS 5.0EG 5.0

2022-12-08

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to ext…

CVE-2022-4201LOWCVSS 3.5EG 5.3

2023-01-27

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

CVE-2022-42149CRITICALCVSS 9.8EG 9.8

2022-10-17

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

CVE-2022-42183CRITICALCVSS 9.1EG 9.1

2023-07-31

Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).

CVE-2022-42343MEDIUMCVSS 6.5EG 6.5

2022-12-16

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the appli…

CVE-2022-42494LOWCVSS 3.0EG 6.5

2022-11-08

Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.

CVE-2022-42890HIGHCVSS 7.5EG 7.5

2022-10-25

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

CVE-2022-42894HIGHCVSS 7.5EG 7.5

2022-11-17

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was identified in one of the web services exposed on the syngo Dynamics application that…

CVE-2022-43140HIGHCVSS 7.5EG 7.5

2022-11-17

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary…

CVE-2022-43183HIGHCVSS 8.8EG 8.8

2022-11-17

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

CVE-2022-4335MEDIUMCVSS 4.3EG 4.3

2023-01-27

A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.

CVE-2022-43698MEDIUMCVSS 4.3EG 4.3

2023-04-15

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.

CVE-2022-43699MEDIUMCVSS 4.3EG 4.3

2023-04-15

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address…

CVE-2022-43776MEDIUMCVSS 6.5EG 6.5

2022-10-26

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.

CVE-2022-43880MEDIUMCVSS 4.4EG 4.4

2024-03-03

IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151.

CVE-2022-44729HIGHCVSS 7.1EG 7.1

2023-08-22

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by defa…

CVE-2022-44730MEDIUMCVSS 4.4EG 4.4

2023-08-22

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter t…

CVE-2022-4492HIGHCVSS 7.5EG 7.5

2023-02-23

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS clie…

CVE-2022-45027MEDIUMCVSS 5.3EG 5.3

2023-01-01

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address.

CVE-2022-45085MEDIUMCVSS 6.5EG 6.5

2023-02-12

Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01.

CVE-2022-45152CRITICALCVSS 9.1EG 9.1

2022-11-25

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which …

CVE-2022-45362HIGHCVSS 7.2EG 7.2

2023-12-07

Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.

CVE-2022-45429HIGHCVSS 7.5EG 7.5

2022-12-27

Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.

CVE-2022-45835MEDIUMCVSS 5.8EG 5.8

2023-11-13

Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.

CVE-2022-45926HIGHCVSS 8.8EG 8.8

2023-01-18

An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.

CVE-2022-46364CRITICALCVSS 9.8EG 9.8

2022-12-13

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any t…

CVE-2022-46830MEDIUMCVSS 4.1EG 5.3

2022-12-08

In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.

CVE-2022-46973CRITICALCVSS 9.8EG 9.8

2023-03-03

Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.

CVE-2022-46998CRITICALCVSS 9.8EG 9.8

2023-01-26

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).

CVE-2022-4725MEDIUMCVSS 5.5EG 5.5

2022-12-27

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manip…

CWE-918— Server-Side Request Forgery (SSRF)

CVEs classified under CWE-918page 15 of 48

Map vulnerabilities like CWE-918 to your infrastructure