#cwe-918

共收录 2015 条相关情报。

漏洞预警2026-09-18 发布INFO

A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote a...

CVE-2026-40537

A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the applicati...

CVE-2026-67101

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functional

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-18 发布INFO

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This...

CVE-2026-12106

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-18 发布INFO

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, all...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-09-18 发布INFO

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before...

CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote insta

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-09-18 发布INFO

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private a...

CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote insta

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-09-18 发布INFO

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate...

CVE-2026-85917

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a netw

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:high

漏洞预警2026-09-17 发布INFO

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-85917

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a netw

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using H...

CVE-2026-54734

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-suppl

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/ed...

CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-09-17 发布INFO

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52...

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker l

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918

漏洞预警2026-09-17 发布INFO

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access rest...

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker l

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in te...

CVE-2026-54918

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the a

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-829 #cwe-918

漏洞预警2026-09-17 发布INFO

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs ho...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359 #cwe-918 #cwe-1385

漏洞预警2026-09-17 发布INFO

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url...

CVE-2026-54339

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passe

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes ...

CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.Creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-209 #cwe-441 #cwe-918

漏洞预警2026-09-17 发布INFO

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an ...

CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-09-17 发布INFO

CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-09-17 发布INFO

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a ...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbn

历史摘要 · 未重新核验 · NVD

#cve #cwe-88 #cwe-522 #cwe-918

漏洞预警2026-09-17 发布INFO

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access cou...

CVE-2026-81446

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-918