Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in axios

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of axios. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relative URLs...

Security Bulletin: Multiple Vulnerabilities in components for Cloud Pak System

Summary Vulnerabilities found in components packaged with Cloud Pak System, Node.js, Express, Axios. Vulnerability Details CVEID:CVE-2024-4068 DESCRIPTION: Node.js braces module is vulnerable to a denial of service, caused by the failure to limit the number of characters it can handle. leading to...

MAL-2024-9728 Malicious code in noblox.ts-axios (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in noblox.ts-axios (npm)

--- -= Per source details. Do not edit below this line.=-...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.34.0 security update & enhancements

Release of OpenShift Serverless Logic 1.34.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: Vulnerability in Axios affects IBM watsonx.data

Summary Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relative URLs. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack. This can affect watsonx.data...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules (CVE-2024-39338, CVE-2024-43800, CVE-2024-43799, CVE-2024-43796).

Summary IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios CVE-2024-39338, expressjs serve-static CVE-2024-43800, pillarjs send CVE-2024-43799 and expressjs express CVE-2024-43796. This bulletin identifies the steps to take to address the...

Security Bulletin: A vulnerability in JavaScript affects IBM License Metric Tool v9 (CVE-2024-39338).

Summary There is a vulnerability in JavaScript library Axios that is used by IBM License Metric Tool. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relativ...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.10 security update

Red Hat OpenShift Service Mesh Containers for 2.4.10 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

SUSE CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

CVE-2024-39338

A vulnerability was found in the Axios HTTP Client. It is vulnerable to a server-side request forgery attack SSRF caused by unexpected behavior where requests for path-relative URLs get processed as protocol-relative URLs. This flaw allows an attacker to perform arbitrary requests from the server...

Moderate: Red Hat Security Advisory: OpenShift Virtualization 4.13.10 Images security update

Red Hat OpenShift Virtualization release 4.13.10 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Server-Side Request Forgery (SSRF)

Axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unexpected behavior where requests for path-relative URLs are processed as protocol-relative URLs...

GHSA-8HC4-VH64-CXMJ Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

31g-form-parser (>=1.0.1, <=1.0.126), 5p-buyform (>=0.0.1, <=0.0.4) +5465 more potentially affected by CVE-2024-39338 via axios (>=1.3.2, <=1.7.3)

axios NPM version =1.3.2, =1.0.1, =0.0.1, =0.0.1, =0.1.2, =2.1.0, =3.0.0-beta.10, =0.2.1, =0.5.0, =0.0.74, =0.0.14, =2.5.4, =1.0.1, =1.14.5, =1.0.30, =1.0.36 and more Source cves: CVE-2024-39338 Source advisory: OSV:GHSA-8HC4-VH64-CXMJ...

Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

DEBIAN-CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

UBUNTU-CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

Axios 安全漏洞

Axios is an HTTP client based on Promise a solution for asynchronous programming from the Axios open source. Axios version 1.7.2 has a security vulnerability that stems from vulnerability to a server-side request forgery attack, where a request for a path-relative URL is processed as a...