Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

The v4isinvalid function in activitypub-federation-rust src/utils.rs does not check for Ipv4Addr::UNSPECIFIED 0.0.0.0. An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 GHSA-7723-35v7-qcxw, and reac...

CVE-2018-25194

creationtimestamp| type| source ---|---|--- 2026-03-06 14:51:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfks6m2qf2u...

EUVD-2025-25194

Malicious code in bioql PyPI...

CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypubfederation and versions 0.19...

CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypubfederation and versions 0.19...

CVE-2025-25194

CVE-2025-25194 describes a Server-Side Request Forgery (SSRF) in Lemmy linked to the activitypub_federation Rust library. The vulnerability allows an attacker to craft a Webfinger-based request that may bypass hardcoded URL/path restrictions and trigger an arbitrary GET to any Host, Port, and URL...

CVE-2025-25194

creationtimestamp| type| source ---|---|--- 2025-02-10 18:41:43+00:00| published-proof-of-concept| https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw 2025-02-10 23:15:40+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhublkatf42q 2025-02-11...

Security Bulletin: Vulnerabilities in Apache Kafke affect watsonx.data

Summary Apache Kafka is vulnerable to denial of service attacks and to arbitrary code executed on the system attacks. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By...

Security Bulletin: There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Asset Management application (CVE-2023-25194)

Summary There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Asset Management application. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio...

Exploit for Deserialization of Untrusted Data in Apache Kafka_Connect

This tool is intended for security testing purposes only. Do not...

Security Bulletin: Apache Kafka is vulnerable to CVE-2022-34917 and CVE-2023-25194 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Apache Kafka which is vulnerable to CVE-2022-34917 and CVE-2023-25194. Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By sending a...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to a code execution vulnerability in Apache Kafka (CVE-2023-25194)

Summary A code execution vulnerability in Apache Kafka used byIBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe...

Security Bulletin: IBM Event Streams is affected by a vulnerability in Apache Kafka (CVE-2023-25194)

Summary This security vulnerability affects Apache Kafka that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization when configurin...

Security Bulletin: Vulnerability in Apache Kafka may affect IBM Business Automation Workflow - CVE-2023-25194

Summary IBM Business Automation Workflow packages a copy Apache Kafka client library. A security vulnerability has been reported for the same version of Apache Kafka. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute...

Security Bulletin: IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is affected by vulnerability in Apache Kafka (CVE-2023-25194)

Summary Apache Kafka is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library as part of the Kafka integration. The latest patch includes Apache Kafka 3.4.0 to fix the vulnerability. CVE-2023-25194 Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could...

Security Bulletin: z/Transaction Processing Facility is affected by vulnerabilities in the Apache Kafka (kafka-clients) and cryptography packages

Summary The Apache Kafka and cryptography packages are used by the z/TPF system in runtime metrics collection and the z/TPF real-time insights dashboard starter kit. The z/TPF system was updated to address the vulnerabilities in these packages described by CVE-2023-25194 and CVE-2023-23931...

CVE-2023-25194

creationtimestamp| type| source ---|---|--- 2023-02-14 06:59:01+00:00| published-proof-of-concept| Telegram/UgjyfN33Nakq6MmMsTBw0rSSkp77M7XZKGq62f2fQ8miTg 2023-02-14 19:43:14+00:00| published-proof-of-concept| https://t.me/malwar3s/32 2023-02-20 06:51:35+00:00| seen| https://t.me/cKure/10688...

Radare2 Resource Management Error Vulnerability (CNVD-2022-25194)

radare2 is a set of libraries and tools for working with binary files. A resource management error vulnerability exists in radare2, which can be exploited by an attacker to trigger a denial of service via a MIPS ELF64 binary by triggering an overload of Radare2...

CVE-2022-25194

A cross-site request forgery CSRF vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials...

CVE-2022-25194

A cross-site request forgery CSRF vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials...