CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2018-2463"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-11T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.",
  "id": "GHSA-74vw-fvv7-2rh7",
  "modified": "2022-05-14T01:54:41Z",
  "published": "2022-05-14T01:54:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2463"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2680834"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105339"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-36085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-28T15:16:12Z",
    "severity": "MODERATE"
  },
  "details": "IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
  "id": "GHSA-74xw-28v9-322g",
  "modified": "2025-10-28T15:30:47Z",
  "published": "2025-10-28T15:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36085"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7249356"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-03T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin\u0026act=dispModuleAdminFileBox SVG upload.",
  "id": "GHSA-756g-77hp-9phc",
  "modified": "2022-05-14T01:32:34Z",
  "published": "2022-05-14T01:32:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19601"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rhymix/rhymix/issues/1089"
    },
    {
      "type": "WEB",
      "url": "https://github.com/security-breachlock/CVE-2018-19601/blob/master/SSRF.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "rudloff/alltube"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-09T15:17:31Z",
    "nvd_published_at": "2022-03-08T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nOn releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).\n\nThe impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)\n\n### Patches\n\n3.0.3 contains a fix for this vulnerability.\n(The 1.x and 2.x releases are not maintained anymore.)\n\nThe fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.\nHowever, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.\n\n### References\n\n* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a\n* https://github.com/ytdl-org/youtube-dl/issues/30691\n",
  "id": "GHSA-75p7-527p-w8wp",
  "modified": "2022-03-09T20:13:46Z",
  "published": "2022-03-09T15:17:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24739"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ytdl-org/youtube-dl/issues/30691"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Rudloff/alltube"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/alltube/releases/tag/3.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server-Side Request Forgery and Open Redirect in AllTube Download"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T04:17:16Z",
    "severity": "LOW"
  },
  "details": "A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.",
  "id": "GHSA-76cc-739m-wwpv",
  "modified": "2026-07-14T06:31:21Z",
  "published": "2026-07-14T06:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15628"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/issues/2878"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/pull/2886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/releases/tag/2.1.2"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15628"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855849"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/378130"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/378130/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-44139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-23T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).",
  "id": "GHSA-76fm-xq85-793j",
  "modified": "2022-03-30T00:01:04Z",
  "published": "2022-03-24T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44139"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alibaba/Sentinel/issues/2451"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-39927"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-18T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.x, between 14.5.0 and 14.5.x, and between 14.6.0 and 14.6.x would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443",
  "id": "GHSA-76g9-63cr-m776",
  "modified": "2022-04-23T00:03:41Z",
  "published": "2022-01-19T00:01:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39927"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39927.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/340476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33690"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-15T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.",
  "id": "GHSA-76pj-fv2h-qvfg",
  "modified": "2022-05-24T19:14:36Z",
  "published": "2022-05-24T19:14:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33690"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3072955"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0613"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-16T13:16:11Z",
    "severity": "HIGH"
  },
  "details": "The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and services, enabling scanning of the Hertzner cloud environment that TheLibrarian uses. The vendor has fixed the vulnerability in all affected versions.",
  "id": "GHSA-76r3-qjqp-qqg4",
  "modified": "2026-01-17T00:30:24Z",
  "published": "2026-01-16T15:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0613"
    },
    {
      "type": "WEB",
      "url": "https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure"
    },
    {
      "type": "WEB",
      "url": "https://thelibrarian.io"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42965"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-29T11:16:16Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.",
  "id": "GHSA-76ww-43j5-78x5",
  "modified": "2026-06-30T03:36:53Z",
  "published": "2026-05-29T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42965"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-42965"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483184"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42965.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}