CVE-2025-23222

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2024-47066

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in "src/app/api/proxy/route.ts" does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

CVE-2024-47066: Server-Side Request Forgery (SSRF)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

PT-2025-4860 · Deepin · Dde-Api-Proxy

Name of the Vulnerable Software and Affected Versions: Deepin dde-api-proxy versions 1.0.0 through 1.0.19 Description: The issue allows unprivileged users to access D-Bus services as root because dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods i...

CVE-2024-6424 Server-Side Request Forgery vulnerability in MESbook

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=ARCHIVO|URL INTERNA|IP/HOST" to re...

PT-2024-37616

Name of the Vulnerable Software and Affected Versions MESbook version 20221021.03 Description The issue allows a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=ARCHIVO|URL...

CVE-2024-6424: Server-Side Request Forgery (SSRF)

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=...

CVE-2024-32964: Server-Side Request Forgery (SSRF)

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

CVE-2024-32964

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...

PT-2024-17983 · WordPress · Leadconnector

Name of the Vulnerable Software and Affected Versions: LeadConnector plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to a missing capability check on the lc public api proxy function, which allows unauthenticated attackers to delete arbitrary posts,...

Improper Access Control

github.com/rancher/rancher is vulnerable to Improper Access Control. The vulnerability is due to the API proxy not dropping the impersonation header before sending the request to the Kubernetes API, allowing an authenticated user to impersonate any user on a cluster...

PT-2024-19422 · Hewlett Packard · Hpe Msa Storage

Name of the Vulnerable Software and Affected Versions: HPE MSA storage products affected versions not specified Description: A potential security issue has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This issue could be exploited to gain elevated...

io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.4.0, <=2.6.0), io.micronaut.aws:micronaut-function-aws-api-proxy (>=2.4.0, <=2.6.0) +4 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.3.4)

io.micronaut:micronaut-http-server MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-aws-alexa-httpserver =2.4.0, =2.4.0, =2.4.0, =2.6.0 -...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.4.0.m2, <=1.4.1), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.4.0.m2, <=1.4.1) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.10)

io.micronaut:micronaut-http-server MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.4.0.m2, =1.4.0.m2, =1.4.1 -...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.1.0.m2, <=1.1.2), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.1.0.m2, <=1.1.1) +11 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.4)

io.micronaut:micronaut-http-server MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.1.0.m2, =1.1.0.m2, =1.1.0.rc2,...

io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.0.0.m1, <=2.0.0.m3), io.micronaut.aws:micronaut-function-aws-api-proxy (>=2.0.0.m1, <=2.0.0.m3) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.0.m2)

io.micronaut:micronaut-http-server MAVEN version 2.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-aws-alexa-httpserver =2.0.0.m1, =2.0.0.m1, =2.0.0.m3 -...

CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-49799

The CVE-2023-49799 entry concerns the nuxt-api-party module, where a regex-based absolute-URL check (^https?://) can be bypassed by absolute URLs with leading whitespace (e.g., a leading newline). This can allow requests to bypass the whitelist, enabling Server-Side Request Forgery (SSRF) and pot...

PT-2022-10547

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.5.10 Description A Improper Access Control issue allows remote attackers to impersonate arbitrary users. This is due to the Steve API proxy not dropping the impersonation header before sending the request to th...