Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2871 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2017-14323 1 Onethink 1 Onethink 2024-11-21 N/A
SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter.
CVE-2017-13667 1 Open-xchange 1 Open-xchange Appsuite 2024-11-21 N/A
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2017-1000452 1 Samlify Project 1 Samlify 2024-11-21 N/A
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
CVE-2017-1000419 1 Phpbb 1 Phpbb 2024-11-21 N/A
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
CVE-2017-0929 1 Dnnsoftware 1 Dotnetnuke 2024-11-21 N/A
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
CVE-2016-6272 1 Epic 1 Mychart 2024-11-21 N/A
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.
CVE-2016-10927 1 Neliosoftware 1 Nelio Ab Testing 2024-11-21 N/A
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
CVE-2016-10926 1 Neliosoftware 1 Nelio Ab Testing 2024-11-21 N/A
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
CVE-2015-6970 1 Boschsecurity 2 Nbn-498 Dinion2x Day\/night Ip Cameras, Nbn-498 Dinion2x Day\/night Ip Cameras Firmware 2024-11-21 9.8 Critical
The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.
CVE-2014-8943 1 Piwigo 1 Lexiglot 2024-11-21 8.8 High
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
CVE-2014-3990 1 Opencart 1 Opencart 2024-11-21 N/A
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
CVE-2014-2560 1 Phoner 1 Phonerlite 2024-11-21 7.5 High
The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
CVE-2014-1409 1 Mobileiron 2 Sentry, Virtual Smartphone Platform 2024-11-21 9.1 Critical
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
CVE-2014-0083 2 Debian, Net-ldap Project 2 Debian Linux, Net-ldap 2024-11-21 5.5 Medium
The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
CVE-2013-4864 1 Micasaverde 2 Veralite, Veralite Firmware 2024-11-21 9.8 Critical
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery (SSRF) issue.
CVE-2013-4857 1 Dlink 2 Dir-865l, Dir-865l Firmware 2024-11-21 9.8 Critical
D-Link DIR-865L has PHP File Inclusion in the router xml file.
CVE-2010-2450 2 Debian, Shibboleth 2 Debian Linux, Service Provider 2024-11-21 7.5 High
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.
CVE-2009-5139 1 Google 1 Gizmo5 2024-11-21 7.5 High
The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
CVE-2007-6758 1 Sencha 1 Ext Js 2024-11-21 7.5 High
Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
CVE-2024-20531 1 Cisco 1 Identity Services Engine 2024-11-20 5.5 Medium
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device.