Export limit exceeded: 17485 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17485 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-1965 | 1 Haivision | 4 Aviwest Manager, Aviwest Streamhub, Maanager and 1 more | 2025-04-10 | 6.5 Medium |
| Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users. | ||||
| CVE-2024-25706 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 6.1 Medium |
| There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks. | ||||
| CVE-2024-6784 | 1 Abb | 41 Aspect-ent-12, Aspect-ent-12 Firmware, Aspect-ent-2 and 38 more | 2025-04-10 | 9.9 Critical |
| Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 | ||||
| CVE-2022-4800 | 1 Usememos | 1 Memos | 2025-04-10 | 6.5 Medium |
| Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. | ||||
| CVE-2025-25785 | 1 Jizhicms | 1 Jizhicms | 2025-04-10 | 9.1 Critical |
| JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request. | ||||
| CVE-2024-51298 | 1 Draytek | 2 Vigor3900, Vigor3900 Firmware | 2025-04-10 | 9.8 Critical |
| In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. | ||||
| CVE-2024-57767 | 1 Wangl1989 | 1 Mysiteforme | 2025-04-10 | 8.6 High |
| MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download. | ||||
| CVE-2022-39039 | 1 Aenrich | 1 A\+hrd | 2025-04-10 | 9.8 Critical |
| aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s) request to launch Server-Side Request Forgery (SSRF) attack, to perform arbitrary system command or disrupt service. | ||||
| CVE-2021-29102 | 1 Esri | 1 Arcgis Server | 2025-04-10 | 9.1 Critical |
| A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2021-29113 | 1 Esri | 1 Arcgis Server | 2025-04-10 | 4.7 Medium |
| A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. | ||||
| CVE-2022-38187 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 7.5 High |
| Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs. | ||||
| CVE-2022-38193 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 6.1 Medium |
| There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution. | ||||
| CVE-2022-38203 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 7.5 High |
| Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212. | ||||
| CVE-2022-38211 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 7.5 High |
| Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212. | ||||
| CVE-2022-38212 | 1 Esri | 1 Portal For Arcgis | 2025-04-10 | 7.5 High |
| Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203. | ||||
| CVE-2024-3788 | 1 Whitebearsolutions | 1 Wbsairback | 2025-04-10 | 6.6 Medium |
| Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of this vulnerability could allow a remote user to execute arbitrary code. | ||||
| CVE-2024-3785 | 1 Whitebearsolutions | 1 Wbsairback | 2025-04-10 | 6.6 Medium |
| Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS). Exploitation of this vulnerability could allow a remote user to execute arbitrary code. | ||||
| CVE-2024-3786 | 1 Whitebearsolutions | 1 Wbsairback | 2025-04-10 | 6.6 Medium |
| Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplication). Exploitation of this vulnerability could allow a remote user to execute arbitrary code. | ||||
| CVE-2022-25926 | 1 Window-control Project | 1 Window-control | 2025-04-10 | 7.4 High |
| Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization. | ||||
| CVE-2024-39932 | 1 Gogs | 1 Gogs | 2025-04-10 | 9.9 Critical |
| Gogs through 0.13.0 allows argument injection during the previewing of changes. | ||||