18057 matches found
CVE-2024-34701
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made...
CVE-2023-43040
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...
CVE-2023-43040 IBM Spectrum Fusion HCI improper access control
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...
PT-2024-19944 · Hcl · Hcl Commerce
Name of the Vulnerable Software and Affected Versions: HCL Commerce versions 9.1.12 through 9.1.13 Description: The issue allows for denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. Recommendations: For versions 9.1.12 and 9.1.13, at t...
PT-2024-6445
Name of the Vulnerable Software and Affected Versions corydolphin/flask-cors versions 4.0.1 corydolphin/flask-cors version 5.0.1 Description The software contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching path...
Server-Side Request Forgery
next is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the Host header within Server Actions. This allows an attacker to make unauthorized requests that appear to originate from the Next.js application server, allowing access to internal network...
PT-2024-9061
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the openvswitch component in the Linux kernel, where the OVS PACKET CMD EXECUTE path has a vulnerability that can lead to incorrect packet matching and...
Next.js Server-Side Request Forgery in Server Actions
Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...
GHSA-FR5H-RQP8-MJ6G Next.js Server-Side Request Forgery in Server Actions
Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...
cri-o: Arbitrary command injection via pod annotation
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...
CVE-2024-34351
Next.js SSRF in Server Actions (CVE-2024-34351) affects self-hosted deployments using Server Actions with redirects to a relative path starting with “/” when Host header can be manipulated. Affected: Next.js prior to 14.1.1 (fixed in 14.1.1). Public writeups and PoC references exist in connected ...
CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...
CVE-2024-34351
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the "Host" header is modified, and the below conditions are also met, an attacker may be able to make requests th...
CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...
CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...
Improper Access Control
gradio is vulnerable to Improper Access Control . The vulnerability is due to improper validation of the isserverfn attribute for functions. This allows attackers to execute functions that should be restricted, potentially leading to unauthorized actions or access to sensitive data...
Malware in actions-next-bundle-analyzer
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2024-4600
Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to lack of proper sanitisation of the ‘setparam.cgi’ file...
CVE-2024-4600 Cross-Site Request Forgery vulnerability in Socomec Net Vision
Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to lack of proper sanitisation of the ‘setparam.cgi’ file...
