Improper Access Control

github.com/rancher/rancher is vulnerable to Improper Access Control. The vulnerability is due to the API proxy not dropping the impersonation header before sending the request to the Kubernetes API, allowing an authenticated user to impersonate any user on a cluster...

PT-2024-19422 · Hewlett Packard · Hpe Msa Storage

Name of the Vulnerable Software and Affected Versions: HPE MSA storage products affected versions not specified Description: A potential security issue has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This issue could be exploited to gain elevated...

CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-49799

The CVE-2023-49799 entry concerns the nuxt-api-party module, where a regex-based absolute-URL check (^https?://) can be bypassed by absolute URLs with leading whitespace (e.g., a leading newline). This can allow requests to bypass the whitelist, enabling Server-Side Request Forgery (SSRF) and pot...

Cross site request forgery (csrf)

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"email protected"' request, which can be followed by a password reset...