CVE-2024-27098

CRITICAL Year: 2024
CVSS v3 Score
9.6
Critical
Weakness Type
CWE-918
View all →

Vulnerability Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

Related Vulnerabilities

CVE-2018-2445

CRITICAL
CVSS:9.6(Critical)

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting...

CWE-9182018

CVE-2019-8982

CRITICAL
CVSS:9.6(Critical)

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.

CWE-9182019

CVE-2024-0440

CRITICAL
CVSS:9.6(Critical)

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.

CWE-9182024

CVE-2024-3149

CRITICAL
CVSS:9.6(Critical)

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded lin...

CWE-9182024

CVE-2024-33857

CRITICAL
CVSS:9.6(Critical)

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forg...

CWE-9182024

CVE-2024-4404

CRITICAL
CVSS:9.6(Critical)

The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, wit...

CWE-9182024