PT-2025-4860 · Deepin · Dde-Api-Proxy

Name of the Vulnerable Software and Affected Versions: Deepin dde-api-proxy versions 1.0.0 through 1.0.19 Description: The issue allows unprivileged users to access D-Bus services as root because dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods i...

CVE-2024-6424 Server-Side Request Forgery vulnerability in MESbook

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=ARCHIVO|URL INTERNA|IP/HOST" to re...

CVE-2024-6424: Server-Side Request Forgery (SSRF)

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=...

PT-2024-37616

Name of the Vulnerable Software and Affected Versions MESbook version 20221021.03 Description The issue allows a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=ARCHIVO|URL...

CVE-2024-32964: Server-Side Request Forgery (SSRF)

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

CVE-2024-32964

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

PT-2024-17983 · WordPress · Leadconnector

Name of the Vulnerable Software and Affected Versions: LeadConnector plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to a missing capability check on the lc public api proxy function, which allows unauthenticated attackers to delete arbitrary posts,...

Improper Access Control

github.com/rancher/rancher is vulnerable to Improper Access Control. The vulnerability is due to the API proxy not dropping the impersonation header before sending the request to the Kubernetes API, allowing an authenticated user to impersonate any user on a cluster...

PT-2024-19422 · Hewlett Packard · Hpe Msa Storage

Name of the Vulnerable Software and Affected Versions: HPE MSA storage products affected versions not specified Description: A potential security issue has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This issue could be exploited to gain elevated...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.1.0.m2, <=1.1.2), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.1.0.m2, <=1.1.1) +11 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.4)

io.micronaut:micronaut-http-server MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.1.0.m2, =1.1.0.m2, =1.1.0.rc2,...

io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.4.0, <=2.6.0), io.micronaut.aws:micronaut-function-aws-api-proxy (>=2.4.0, <=2.6.0) +4 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.3.4)

io.micronaut:micronaut-http-server MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-aws-alexa-httpserver =2.4.0, =2.4.0, =2.4.0, =2.6.0 -...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.4.0.m2, <=1.4.1), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.4.0.m2, <=1.4.1) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.10)

io.micronaut:micronaut-http-server MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.4.0.m2, =1.4.0.m2, =1.4.1 -...

io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.0.0.m1, <=2.0.0.m3), io.micronaut.aws:micronaut-function-aws-api-proxy (>=2.0.0.m1, <=2.0.0.m3) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.0.m2)

io.micronaut:micronaut-http-server MAVEN version 2.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-aws-alexa-httpserver =2.0.0.m1, =2.0.0.m1, =2.0.0.m3 -...

CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-49799

The CVE-2023-49799 entry concerns the nuxt-api-party module, where a regex-based absolute-URL check (^https?://) can be bypassed by absolute URLs with leading whitespace (e.g., a leading newline). This can allow requests to bypass the whitelist, enabling Server-Side Request Forgery (SSRF) and pot...

PT-2022-10547

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.5.10 Description A Improper Access Control issue allows remote attackers to impersonate arbitrary users. This is due to the Steve API proxy not dropping the impersonation header before sending the request to th...

io.micronaut.aws:micronaut-function-aws-alexa (>=1.1.0.m2, <=1.1.2), io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.1.0.m2, <=1.1.2) +49 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (1.0.4)

io.micronaut:micronaut-http MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.micronaut.aws:micronaut-function-aws-alexa =1.1.0.m2, =1.1.0.m2, =1.1.0.m2, =1.0.4, =1.0.0.rc3,...

io.micronaut.aws:micronaut-aws-alexa (>=2.0.0.m1, <=2.0.0.m3), io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.0.0.m1, <=2.0.0.m3) +36 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (2.0.0.m2)

io.micronaut:micronaut-http MAVEN version 2.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.micronaut.aws:micronaut-aws-alexa =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1,...

Cross site request forgery (csrf)

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"email protected"' request, which can be followed by a password reset...