CVE-2024-52579: Server-Side Request Forgery (SSRF)

Misskey is an open source, federated social media platform. Some APIs using HttpRequestService do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or...

PT-2024-35378

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2024.11.0-alpha.3 Description Misskey is an open source, federated social media platform. Some APIs using HttpRequestService do not properly check the target host. This issue allows an attacker to send POST or GET...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8384

Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...

CVE-2017-8384: Improper Neutralization of Input During Web Page Generation

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...