carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2023-46137 via twisted (22.4.0)

twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2023-46137 Source advisory:...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2023-46137 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2023-46137 Source advisory: OSV:PYSEC-2023-224...

geonode (3.3.3) potentially affected by CVE-2023-46137 via twisted (22.4.0rc1)

twisted PYPI version 22.4.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - geonode 3.3.3 Source cves: CVE-2023-46137 Source advisory: OSV:PYSEC-2023-224...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2023-5752 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2023-5752 Source advisory: OSV:GHSA-MQ26-G339-26XF...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2023-5752 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2023-5752 Source advisory: OSV:PYSEC-2023-228...

django-filebrowser (3.13.2), geonode (3.3.3) +2 more potentially affected by CVE-2021-46898 via django-grappelli (>=2.10.1, <=2.15.1)

django-grappelli PYPI version =2.10.1, =6.5.0, =1.12.1, =1.13.0.dev10 Source cves: CVE-2021-46898 Source advisory: GHSA-9X43-5QCQ-H79Q...

django-filebrowser (3.13.2), geonode (3.3.3) +2 more potentially affected by CVE-2021-46898 via django-grappelli (>=2.10.1, <=2.15.1)

django-grappelli PYPI version =2.10.1, =6.5.0, =1.12.1, =1.13.0.dev10 Source cves: CVE-2021-46898 Source advisory: MEND:CVE-2021-46898...

Server Side Request Forgery

GeoNode is vulnerable to Server Side Request Forgery. The vulnerability is due to bypassing the existing application whitelist using the @ or %40 character as a credential to the host geoserver on port 8080. This can be exploited by the attacker to fetch internal sensitive resources...

GHSA-PXG5-H34R-7Q8P GeoNode vulnerable to SSRF Bypass to return internal host data

A SSRF vulnerability exists, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. the application is using a whitelist, but the whitelist can be bypassed with @ and encoded value of @ %4...

Server-Side Request Forgery (SSRF)

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-42439

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

Server side request forgery (ssrf)

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

PYSEC-2023-176

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

PYSEC-2023-176

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-42439 GeoNode SSRF Bypass to return internal host data

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-42439

GeoNode CVE-2023-42439 describes a Server-Side Request Forgery (SSRF) bypass vulnerability that bypasses the whitelist by manipulating the first host into a whitelisted address using @ or %40 as credentials to the geoserver (port 8080). The result is a full read SSRF that can return data from int...

CVE-2023-42439 GeoNode SSRF Bypass to return internal host data

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-42439

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-42439 GeoNode SSRF Bypass to return internal host data

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

GeoNode Code Issues Vulnerabilities

GeoNode is an open source platform that facilitates the creation, sharing and collaborative use of geospatial data. A code issue vulnerability exists in GeoNode that stems from the presence of a cross-site request forgery vulnerability that can bypass existing controls on the software...