Important: docker

Issue Overview: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

GHSA-G872-JWWR-VGGM Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

CVE-2024-41813 txtdot SSRF vulnerability in /proxy

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery SSRF vulnerability in the /proxy route of txtdot allows remote attackers to use the server as a proxy ...

CVE-2024-41813 txtdot SSRF vulnerability in /proxy

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery SSRF vulnerability in the /proxy route of txtdot allows remote attackers to use the server as a proxy ...

CVE-2024-41813 txtdot SSRF vulnerability in /proxy

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery SSRF vulnerability in the /proxy route of txtdot allows remote attackers to use the server as a proxy ...

CVE-2024-41812

TxtDot, an HTTP proxy, is affected by a Server-Side Request Forgery (SSRF) vulnerability in the /get route prior to version 1.7.0. An attacker can use the server as a proxy to send HTTP GET requests to arbitrary targets and access internal-network information. Version 1.7.0 mitigates by not displ...

CVE-2024-41812 txtdot SSRF vulnerability in /get

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery SSRF vulnerability in the /get route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to...

PT-2024-29580 · Txtdot · Txtdot

Name of the Vulnerable Software and Affected Versions: txtdot versions 1.4.0 through 1.6.0 Description: A Server-Side Request Forgery SSRF issue exists in the /proxy route, allowing remote attackers to send HTTP GET requests to arbitrary targets and retrieve internal network information...

TxtDot 安全漏洞

TxtDot is an HTTP proxy from the TxtDot open source. A security vulnerability exists in TxtDot version 1.4.0 through versions prior to 1.6.1. A remote attacker could exploit the vulnerability to send HTTP GET requests to arbitrary targets using the server as a proxy and retrieve information on an...

TxtDot 安全漏洞

TxtDot is an HTTP proxy from TxtDot Open Source. A security vulnerability exists in TxtDot versions prior to 1.7.0. A remote attacker exploited the vulnerability to send an HTTP GET request to an arbitrary target using the server as a proxy and retrieve information in an internal network...

How to Successfully Test Citrix StoreFront Beacons Inside a Remote Desktop Session

This article describes how to successfully test the Citrix StoreFront Beacons functionality with Citrix Receiver 3.1 Standard or later when connecting to workstations using a Remote Desktop session RDP. By default, a configured Citrix Receiver 3.1 Standard or later with Beacons and stores always...

CVE-2024-34689

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of th...

CVE-2024-39598

SAP CRM WebClient UI Framework allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the applicati...

Server Side Request Forgery (SSRF)

@fedify/fedify is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused by making HTTP requests to internal IP addresses referenced in received activities or media URLs, which allows an attacker to send requests to resources within the Fedify server's internal network...

PT-2024-28549 · Sap · Sap Crm

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI Framework affected versions not specified Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting i...

PT-2024-26108 · Sap · Sap Business Workflow

Name of the Vulnerable Software and Affected Versions: SAP Business Workflow affected versions not specified Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting in...

CVE-2024-39687 Fedify vulnerable to allowing access to internal network resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the @id or other resources present within the activity it has...

CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Exploit for Server-Side Request Forgery in Cisco Finesse

Description A vulnerability in the web-based management inte...

CVE-2024-5186 Server Side Request Forgery (SSRF) in imartinez/privategpt

A Server-Side Request Forgery SSRF vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically,...