HubSpot < 8.8.15 - Contributor+ Blind SSRF

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191

SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.

EXMAGE < 1.0.7 - Admin+ Blind SSRF

The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.

Server-Side Request Forgery (SSRF) in rudloff/alltube

Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

Formcraft3 < 3.8.28 - Unauthenticated SSRF

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Server-Side Request Forgery (SSRF) in chocobozzz/peertube

Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.

Server-Side Request Forgery (SSRF) in chocobozzz/peertube

peertube is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) in transloadit/uppy

uppy is vulnerable to Server-Side Request Forgery (SSRF)