CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,758 vulnerabilities with CWE-918
CVE-2017-14585
HIGH
Hipchat Server <2.2.6, Hipchat Data Center <3.1.0 - SSRF
CVSS 7.2
CVE-2017-4928
HIGH
VMware vCenter Server < 6.0 U3c - Server-Side Request Forgery and CRLF Injection via Flash-based vSphere Web Client
CVSS 7.5
CVE-2017-16870
HIGH
UpdraftPlus < 1.13.12 - Authenticated Server-Side Request Forgery via updraft_ajax_handler
CVSS 8.1
CVE-2017-1000237
CRITICAL
scilico i_librarian <=4.6 - Server-Side Request Forgery via ajaxsupplement.php
CVSS 9.8
CVE-2017-0907
CRITICAL
Recurly Client .NET Library <1.0.1-1.8.1 - SSRF
CVSS 9.8
CVE-2017-0906
CRITICAL
Recurly Client Python Library <2.0.5-2.6.2 - SSRF
CVSS 9.8
CVE-2017-0905
CRITICAL
Recurly Client Ruby Library <2.0.13-2.11.3 - SSRF
CVSS 9.8
CVE-2017-0889
CRITICAL
Paperclip 3.1.4-5.1.9 - Server-Side Request Forgery via UriAdapter
CVSS 9.8
CVE-2017-1000139
HIGH
Mahara <1.8.7, <1.9.5, <1.10.3, <15.04.0 - SSRF
CVSS 8.0
CVE-2017-15644
HIGH
Webmin < 1.850 - Server-Side Request Forgery via PATH_INFO to tunnel/link.cgi
CVSS 8.6
CVE-2017-7553
MEDIUM
App Studio - Server-Side Request Forgery
CVSS 6.3
CVE-2017-12905
CRITICAL
Vebto Pixie Image Editor 1.4 and 1.7 - Server-Side Request Forgery via Launderer.php URL Parameter
CVSS 10.0
CVE-2017-12071
MEDIUM
Synology Photo Station <6.7.4-3433, <6.3-2968 - SSRF
CVSS 6.5
CVE-2017-9458
CRITICAL
Palo Alto Networks PAN-OS XML External Entity Injection in GlobalProtect Gateway Interface
CVSS 9.8
CVE-2017-9506
MEDIUM
Atlassian OAuth Plugin <1.9.12, <2.0.4 - SSRF/XSS
CVSS 6.1
CVE-2017-11149
MEDIUM
Synology Download Station 3.x < 3.5-2984 and 3.8.x < 3.8.5-3475 - Authenticated Server-Side Request Forgery
CVSS 6.5
CVE-2017-11148
MEDIUM
Synology Chat < 1.1.0-0806 - Authenticated Server-Side Request Forgery via Link Preview
CVSS 6.5
CVE-2017-1000017
HIGH
phpMyAdmin 4.0-4.0.10.19, 4.6-4.6.6 - Authenticated Server-Side Request Forgery via MySQL Server Connection
CVSS 8.8
CVE-2017-10973
MEDIUM
FineCMS < 2017-05-12 - Server-Side Request Forgery via HTTP Host Header
CVSS 6.5
CVE-2017-6036
MEDIUM
Belden Hirschmann GECKO Lite Managed Switch Firmware < 2.0.00 - Server-Side Request Forgery
CVSS 6.5
CVE-2017-9355
HIGH
Subsonic 6.1.1 - Server-Side Request Forgery via Import Playlist Feature
CVSS 7.4
CVE-2017-9307
MEDIUM
Allen Disk 1.6 - Authenticated Server-Side Request Forgery via remotedownload.php File Parameter
CVSS 6.5
CVE-2017-9066
HIGH
WordPress < 4.7.4 - Server-Side Request Forgery via HTTP Redirect Validation
CVSS 8.6
CVE-2017-8794
CRITICAL
Accellion File Transfer Appliance < 9_12_40 - Server-Side Request Forgery via URL Validation Bypass
CVSS 10.0
CVE-2017-3546
MEDIUM
Oracle PeopleSoft Products - Unauth Info Disclosure
CVSS 6.5
Details
Vulnerabilities
2,758