SSRF

Server-Side Request Forgery (SSRF) · 服务端请求伪造

服务端请求伪造 / SSRF

293公开报告

—CWE 编号

0已标注发现方式

293关联报告

发现方式分布

暂无发现方式标注。

关联报告

SSRF in Exchange leads to ROOT access in all instancesShopify · 2018-05-23 · 低危 · 587 票 Server Side Request Forgery (SSRF) via Analytics ReportsHackerOne · 2023-12-08 · 高危 · $25,000 · 529 票 Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · 2020-11-30 · 未评级 · 421 票 Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureDropbox · — · 未评级 · $4,913 · 360 票 SSRF on project import via the remote_attachment_url on a NoteGitLab · 2020-06-07 · 中危 · $10,000 · 359 票 Server Side Request Forgery mitigation bypassGitLab · 2020-04-18 · 中危 · 350 票 Blind SSRF to internal services in matrix preview_link APIReddit · 2023-04-26 · 中危 · $6,000 · 344 票 TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesSlack · 2020-03-12 · 高危 · $3,500 · 323 票 Full Response SSRF via Google DriveDropbox · — · 未评级 · $17,576 · 302 票 SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Vimeo · 2019-12-13 · 高危 · 276 票 SSRF on fleet.city-mobil.ru leads to local file readMail.ru · — · 未评级 · 272 票 Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionEvernote · 2021-12-06 · 高危 · 264 票 SSRF in graphQL query (pwapi.ex2b.com)EXNESS · 2023-07-24 · 低危 · $3,000 · 261 票 Unauthenticated blind SSRF in OAuth Jira authorization controllerGitLab · 2019-03-14 · 中危 · $4,000 · 238 票 SSRF & LFR on city-mobil.ruMail.ru · — · 未评级 · 237 票 Full Read SSRF on Gitlab's Internal GrafanaGitLab · 2020-08-07 · 高危 · 229 票 SSRF in webhooks leads to AWS private keys disclosureOmise · 2019-06-28 · 中危 · 214 票 Stored XSS & SSRF in Lark DocsLark Technologies · 2021-02-05 · 高危 · $3,000 · 178 票 SSRF on duckduckgo.com/iu/DuckDuckGo · 2018-09-09 · 中危 · 165 票 Server Side Request ForgeryLark Technologies · 2021-03-29 · 高危 · 164 票 External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingTikTok · 2021-02-15 · 中危 · $2,727 · 162 票 SSRF in Autodesk Rendering leading to account takeoverAutodesk · 2025-03-18 · 高危 · 161 票 SSRF chained to hit internal host leading to another SSRF which allows to read internal images.PlayStation · 2021-03-30 · 中危 · $1,000 · 148 票 DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolPortSwigger Web Security · 2025-10-08 · 低危 · 144 票 Blind SSRF on errors.hackerone.net due to Sentry misconfigurationHackerOne · 2018-07-04 · 低危 · $3,500 · 143 票 SSRF in https://couriers.indrive.com/api/file-storageinDrive · 2024-01-16 · 中危 · 141 票 Server Side Request Forgery (SSRF) in webhook functionalityHackerOne · 2024-01-30 · 低危 · $2,500 · 140 票 SSRF on music.line.me through getXML.phpLY Corporation · 2020-03-25 · 中危 · $4,500 · 135 票 SSRF in clients.city-mobil.ruMail.ru · — · 未评级 · $1,500 · 132 票 SSRF in filtering on relap.ioMail.ru · — · 未评级 · 130 票 SSRF In Get Video ContentsSemrush · 2019-08-19 · 低危 · 125 票 Full read SSRF via Lark Docs `import as docs` featureLark Technologies · 2022-01-28 · 高危 · $5,000 · 124 票 Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumerationEXNESS · 2023-10-25 · 低危 · 120 票 Server-Side Request Forgery (SSRF) via Game Export APILichess · 2025-06-03 · 高危 · 116 票 [H1-415 2020] CTF Writeuph1-ctf · 2020-02-03 · 高危 · 108 票 Header modification results in disclosure of Slack infra metadata to unauthorized partiesSlack · 2021-06-09 · 低危 · 97 票 [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameterMail.ru · — · 未评级 · 95 票 [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierStripo Inc · 2025-12-01 · 高危 · 92 票 Blind SSRF in horizon-heatMail.ru · — · 未评级 · $2,500 · 91 票 Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerShopify · 2019-03-14 · 低危 · $1,000 · 90 票 SSRF and LFI in site-audit toolSemrush · 2020-04-30 · 中危 · 86 票 SSRF in api.slack.com, using slash commands and bypassing the protections.Slack · 2019-02-22 · 低危 · 84 票 Blind SSRF in emblem editor (2)Rockstar Games · 2017-10-28 · 低危 · $1,500 · 83 票 SVG Server Side Request Forgery (SSRF)Shopify · 2017-09-22 · 低危 · $500 · 81 票 SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )DuckDuckGo · 2026-09-17 · 低危 · $500 · 77 票 SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"QIWI · — · 未评级 · 77 票 Libuv: Improper Domain Lookup that potentially leads to SSRF attacksInternet Bug Bounty · 2024-03-29 · 中危 · $4,860 · 74 票 GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryGitLab · 2019-12-12 · 中危 · 72 票 SSRF in CI after first runGitLab · 2019-04-12 · 低危 · 72 票 SSRF and secret key disclosure found on Turbonomic endpointIBM · 2024-09-19 · 中危 · 71 票 mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Acronis · 2022-10-13 · 高危 · $1,000 · 71 票 Blind SSRF on debug.nordvpn.com due to misconfigured sentry instanceNord Security · — · 未评级 · 70 票 Lack of sanitization of the billing address in pdf invoiceSemrush · 2024-03-06 · 中危 · 66 票 SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)arkadiyt-projects · 2026-03-31 · 中危 · 65 票 connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scan8x8 · 2023-05-15 · 低危 · 65 票 SSRF with information disclosureLark Technologies · 2021-04-27 · 低危 · 64 票 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addressesBasecamp · 2025-12-22 · 低危 · 62 票 External service interaction (HTTP)AWS VDP · 2024-10-04 · 中危 · 62 票 Blind SSRF External Interaction on ████████MTN Group · 2022-08-21 · 中危 · 61 票 SSRF and local file disclosure by video upload on https://www.redtube.com/uploadPornhub · — · 未评级 · $500 · 61 票 SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciMTN Group · 2024-09-26 · 低危 · 60 票 [SSRF] Server-Side Request Forgery at https://sea-web.gold.razer.com/dev/simulator via notify_url ParameterRazer · — · 未评级 · $2,000 · 60 票 FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comGitLab · 2021-07-13 · 中危 · 58 票 Inappropriate URL parsing may cause security risk!Internet Bug Bounty · 2019-11-12 · 低危 · $1,000 · 58 票 SSRF to read AWS metaData at https://█████/ [HtUS]U.S. Dept Of Defense · 2022-10-14 · 高危 · $1,000 · 57 票 SSRF and secret key disclosure found on Turbonomic endpointIBM · 2024-09-19 · 中危 · 56 票 [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesh1-ctf · 2020-02-03 · 高危 · 56 票 Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/formLY Corporation · 2020-08-02 · 低危 · $1,350 · 56 票 SSRF in hatchful.shopify.comShopify · 2019-04-04 · 低危 · $500 · 56 票 Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationCloudflare Public Bug Bounty · 2022-08-31 · 低危 · 54 票 blind Server-Side Request Forgery (SSRF) allows scanning internal portsElastic · 2023-05-05 · 低危 · 54 票 SSRF By adding a custom integration on console.helium.comHelium · 2021-05-26 · 中危 · 54 票 Blind SSRF in magnum upgrade_paramsMail.ru · — · 未评级 · $2,500 · 54 票 Blind SSRF at https://chaturbate.com/notifications/update_push/Chaturbate · 2018-10-21 · 中危 · 54 票 Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal portsMozilla · 2024-01-12 · 低危 · 53 票 Blind SSRF vulnerability on cz.acronis.comAcronis · 2024-08-27 · 低危 · 53 票 SSRF and local file disclosure by video upload on https://www.tube8.com/Pornhub · — · 未评级 · $500 · 53 票 Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Node.js · 2026-02-12 · 低危 · 52 票 Unauthenticated full-read SSRF via Twilio integrationRocket.Chat · 2024-08-04 · 中危 · 52 票 Bypass of the SSRF protection in Event Subscriptions parameter.Slack · 2019-02-22 · 低危 · 52 票 SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCERockstar Games · 2018-01-12 · 中危 · $1,500 · 52 票 SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XKubernetes · 2022-12-10 · 低危 · $1,000 · 51 票 Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRFStripe · 2022-03-23 · 低危 · 51 票 Internal SSRF bypass using slash commands at api.slack.comSlack · 2018-07-12 · 低危 · 51 票 BLIND SSRF ON http://jsgames.mail.ru via avaOp parameterMail.ru · — · 未评级 · 49 票 SSRF - Unchecked Snippet IDs for distributed filesOpen-Xchange · — · 未评级 · $1,500 · 49 票 CreatorID leaked from public content posted to SnapMapsSnapchat · 2020-12-18 · 低危 · $1,000 · 49 票 SSRF in VCARD photo upload functionalityOpen-Xchange · — · 未评级 · $850 · 49 票 SSRF via User-Controlled Push proxyServer in Notifications Push RegistrationNextcloud · 2026-09-30 · 低危 · 48 票 SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]U.S. Dept Of Defense · 2022-09-14 · 高危 · $4,000 · 46 票 important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)Internet Bug Bounty · 2024-07-13 · 中危 · $4,920 · 45 票 Upload profile photo from URLHackerOne · 2014-02-15 · 未评级 · 44 票 SSRF via URL Parser Differential in `normalize_request_url` (wlc)Weblate · 2026-09-02 · 中危 · 43 票 Server-Side Request Forgery (SSRF) in Ghost CMSNode.js third-party modules · 2020-03-09 · 低危 · 43 票 XSPA on API service endpointPolymail, Inc. · — · 未评级 · 43 票 SSRF in Search.gov via ?url= parameterGSA Bounty · 2019-08-26 · 低危 · $150 · 43 票 SSRF - Blacklist bypass for mail account additionOpen-Xchange · — · 未评级 · $500 · 43 票 DNS Rebinding Attackarkadiyt-projects · 2025-10-19 · 高危 · 42 票 SSRF on http://www.███████/crossdomain.php via url parameterSony · 2022-10-06 · 高危 · 42 票 SSRF in the application's image export functionalityVisma Public · — · 未评级 · $250 · 42 票

查看全部 293 份报告 →