CVE-2024-29028

The CVE-2024-29028 entry concerns the memos service (GitHub project usememos/memos). It documents a Server-Side Request Forgery (SSRF) vulnerability in the API endpoint /o/get/httpmeta in version 0.13.2, allowing unauthenticated users to enumerate the internal network and read limited HTML values...

CVE-2024-29028 memos vulnerable to an SSRF in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

CVE-2024-29028 memos vulnerable to an SSRF in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

CVE-2024-29030 memos vulnerable to an SSRF in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

CVE-2024-29030

CVE-2024-29030 : The memos project (github.com/usememos/memos) has a reported SSRF in the /api/resource endpoint affecting version 0.13.2. Authenticated users could enumerate internal network resources via this endpoint. The Nuclei template and Red Hat/OSV/NVD references corroborate this SSRF iss...

CVE-2024-29030 memos vulnerable to an SSRF in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

CVE-2024-29030 memos vulnerable to an SSRF in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

OESA-2024-1467 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking...

memos 安全漏洞

memos is an open source hosted memos center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which originates in /api/resource and allows authenticated users to enumerate the internal network...

memos 安全漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which stems from /o/get/image allows an unauthenticated user to enumerate the internal network and retrieve images, with the response to the image...

Server-side Request Forgery (SSRF)

gradio is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of the 'file' parameter in a GET request, enabling attackers to scan and identify open ports within an internal network by observing responses for 'Location' headers or 'File not allowed' error...

PT-2024-22683 · Memos · Memos

Name of the Vulnerable Software and Affected Versions: memos versions 0.13.2 through 0.21.x Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. It exists at the /api/resource endpoint, allowing authenticated users to enumerate the internal network...

GHSA-QH6X-J82H-VPF9 gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183 SSRF Vulnerability in gradio-app/gradio

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

Gradio (gradio-app/gradio) contains an SSRF flaw exposed via the file parameter in a GET request. The vulnerability enables an unauthenticated attacker to probe internal networks by observing responses (e.g., Location headers or “File not allowed” messages) to identify open ports. The Nuclei temp...

PT-2024-17278

Name of the Vulnerable Software and Affected Versions gradio-app/gradio affected versions not specified Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to scan and identify open ports within an internal network. By manipulating the file parameter in a GET request, ...

Gradio 输入验证错误漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from an input validation error vulnerability that stems from the presence of a server-side request forgery vulnerability that allows an attacker to scan an...

PT-2024-7807 · Milestone Systems · Xprotect Device Pack

Name of the Vulnerable Software and Affected Versions: Siveillance Video formerly Siveillance VMS versions affected versions not specified XProtect Device Pack versions affected versions not specified Description: The issue is related to a buffer overflow vulnerability due to the lack of size...