CWE-918

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking

An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Serve

An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows rem

GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was cr

The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attack

An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibil

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Serv

"HCL Digital Experience is susceptible to Server Side Request Forgery."

Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview u

Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of th

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an ini

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in ind

Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv

GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other an

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature.

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to t

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw

The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Tabl

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location head

SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of serv

Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.

An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable

Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful ex

Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful ex

Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Success

An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, w

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe,

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an att

MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attri

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF). This may allow an authe

In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.

WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the X