Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

Moderate: Red Hat Security Advisory: OpenShift Virtualization 4.12.12 Images security update

Red Hat OpenShift Virtualization release 4.12.12 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

PT-2025-10093

Name of the Vulnerable Software and Affected Versions: axios versions 1.0.0 through 1.8.1 Bamboo Data Center and Server versions 9.6.1 through 11.0.0 Description: A Server-Side Request Forgery SSRF vulnerability exists in axios when handling absolute URLs instead of protocol-relative URLs. Even...

Security Bulletin: axios-1.5.0.tgz and axios-1.5.1.tgz is vulnerable to CVE-2023-45857 used in IBM Maximo Application Suite - Edge Data Collector

Summary IBM Maximo Application Suite - Edge Data Collector uses axios-1.5.0.tgz and axios-1.5.1.tgz which is vulnerable to CVE-2023-45857 Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input...

DEBIAN-CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

PT-2023-8832

Name of the Vulnerable Software and Affected Versions Axios versions 0.8.1 through 1.5.1 Description The issue is related to a JavaScript library and involves a cross-site request forgery vulnerability. This vulnerability can allow a remote attacker to gain unauthorized access to the XSRF-TOKEN...

Security Bulletin: App Connect Professional & IBM WebSphere Cast Iron Solution are affected by axios vulnerability

Summary App Connect Professional & IBM WebSphere Cast Iron Solution have addressed the following vulnerability reported in axios. Vulnerability Details CVEID: CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

-lidonghui (=1.0.0), -tompan-reacttemplate (>=1.0.1 <=1.1.0) +54288 more potentially affected by CVE-2021-3749 via axios (>=0.10.0 <=0.21.1)

axios NPM version =0.10.0, =1.0.1, =1.0.1, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest =1.0.0 - 04-17 =1.0.0 - 04-17zy =1.0.0 - 04-a =1.0.0 - 04-code =1.0.0 - 05-clima-mundo =1.0.0 - 0726react =0.1.1 - 0a =1.0.0 - 0c =1.0.0 and more Source cves: CVE-2021-3749 Source advisory:...

-lidonghui (=1.0.0), -tompan-reacttemplate (>=1.0.1 <=1.1.0) +51398 more potentially affected by CVE-2020-28168 via axios (>=0.10.0 <=0.21.0)

axios NPM version =0.10.0, =1.0.1, =1.0.1, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest =1.0.0 - 04-17 =1.0.0 - 04-17zy =1.0.0 - 04-a =1.0.0 - 04-code =1.0.0 - 05-clima-mundo =1.0.0 - 0726react =0.1.1 - 0a =1.0.0 - 0c =1.0.0 and more Source cves: CVE-2020-28168 Source advisory:...

Axios NPM package code issue vulnerability

Axios is an HTTP client based on Promise a solution for asynchronous programming. A security vulnerability exists in the Axios NPM package version 0.21.0, which can be exploited by an attacker to be able to bypass the proxy by providing a URL that responds to a restricted host or IP address via a...

CVE-2019-10742

Axios up to and including 0.18.0 allows attackers to cause a denial of service application crash by continuing to accepting content after maxContentLength is exceeded...

DEBIAN-CVE-2019-10742

Axios up to and including 0.18.0 allows attackers to cause a denial of service application crash by continuing to accepting content after maxContentLength is exceeded...

10chars-test (>=1.0.0 <=1.0.34), 12366.ui-comp (=0.0.1) +9227 more potentially affected by CVE-2019-10742 via axios (>=0.10.0 <=0.18.0)

axios NPM version =0.10.0, =1.0.0, =1.0.0, =1.2.0, =1.0.0, =0.3.11, =0.3.3, =0.3.0, =1.0.0, =0.2.0, =0.2.1 and more Source cves: CVE-2019-10742 Source advisory: SNYK:JS-AXIOS-174505...

Denial of Service (DoS)

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Denial of Service DoS due to content continuing to be accepted from requests after maxContentLength is exceeded. PoC require'axios'.get...