Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

CVEs (3,995)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-34811 1Synology 1Download Station Jun 17, 2026 Jun 18, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.
CVE-2021-34808 1Synology 1Media Server Jun 17, 2026 Jun 18, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-20483 1Ibm 1Security Identity Manager Jun 17, 2026 Jun 16, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data....Show more IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591.Show less
CVE-2021-32682 1Std42 1Elfinder Jun 17, 2026 Jun 14, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands o...Show more elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.Show less
CVE-2021-22175 1Gitlab 1Gitlab Oct 1, 2026 Jun 11, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even...Show more When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabledShow less
CVE-2020-15377 1Broadcom 1Sannav Jun 17, 2026 Jun 9, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF).
CVE-2021-31950 1Microsoft 2Sharepoint Foundation Sharepoint Server Jun 17, 2026 Jun 8, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-33571 2Djangoproject Fedoraproject 2Django Fedora Jun 17, 2026 Jun 8, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of...Show more In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .Show less
CVE-2021-22214 1Gitlab 1Gitlab Jun 17, 2026 Jun 8, 2021 N/A· v4 8.6 HIGH· v3 4.3 MEDIUM· v2 When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacke...Show more When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limitedShow less
CVE-2020-35970 1Yzmcms 1Yzmcms Jun 17, 2026 Jun 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read.
CVE-2021-20348 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to networ...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.Show less
CVE-2021-20347 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to networ...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194596.Show less
CVE-2021-20346 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to networ...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595.Show less
CVE-2021-20345 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to networ...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.Show less
CVE-2021-20343 1Ibm 9Collaborative Lifecycle Management Engineering Lifecycle ManagementEngineering Lifecycle Optimization Engineering Insights+6 more Jun 17, 2026 Jun 2, 2021 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to networ...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.Show less
CVE-2021-33184 1Synology 1Download Station Jun 17, 2026 Jun 1, 2021 N/A· v4 7.7 HIGH· v3 4.0 MEDIUM· v2 Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2021-33181 1Synology 1Video Station Jun 17, 2026 Jun 1, 2021 N/A· v4 9.1 CRITICAL· v3 6.5 MEDIUM· v2 Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
CVE-2021-25640 1Apache 1Dubbo Jun 17, 2026 Jun 1, 2021 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
CVE-2020-14328 1Redhat 1Ansible Tower Jun 17, 2026 May 27, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing add...Show more A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.Show less
CVE-2020-14327 1Redhat 1Ansible Tower Jun 17, 2026 May 27, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it....Show more A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.Show less

Previous 1...178179180...200 Next