CVE-2024-27898

SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request...

CVE-2024-27898 Server-Side Request Forgery in SAP NetWeaver

SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request...

CVE-2024-27898 Server-Side Request Forgery in SAP NetWeaver

SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request...

CVE-2024-27898

CVE-2024-27898 concerns SAP NetWeaver SSRF due to insufficient input validation. The vulnerability allows an unauthenticated or internal-web-app–initiated request to reach internal systems behind firewalls, enabling server-side request forgery with a low confidentiality impact. Documented metrics...

Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets

Microsoft on Friday revealed that the Kremlin-backed threat actor known as Midnight Blizzard aka APT29 or Cozy Bear managed to gain access to some of its source code repositories and internal systems following a hack that came to light in January 2024. "In recent weeks, we have seen evidence that...

PT-2023-29904 · Unknown · Motors – Car Dealer

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealer, Classifieds & Listing versions 1.4.6 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This issue allows an attacker to forge requests from the server, potentially leading to...

CVE-2023-46124

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and...

Server Side Request Forgery (SSRF)

ethyca-fides is vulnerable to Server Side Request Forgery. The vulnerability arises due to application's inability to perform validation against access of internal resources. A specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems...

CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and...

Uber Says It's Investigating a Potential Breach of Its Computer Systems

Ride hailing giant Uber disclosed Thursday it's responding to a cybersecurity incident involving a breach of its network and that it's in touch with law enforcement authorities. The New York Times first reported the incident. The company pointed to its tweeted statement when asked for comment on...

CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

Hackers Compromise Employee Accounts to Access Twilio Internal Systems

By Waqas Twilio says the threat actors behind the attack had "sophisticated abilities to match employee names from sources with… This is a post from HackRead.com Read the original post: Hackers Compromise Employee Accounts to Access Twilio Internal Systems...

Jamf Private Access 安全漏洞

Jamf Private Access is a cloud-based solution from Jamf USA, Inc. It is used for remote access. A security vulnerability exists in versions of Jamf Private Access prior to 2022-05-16 that stems from having incorrect access control. An attacker could exploit the vulnerability to access systems in...

CVE-2021-36203

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

CVE-2021-36203

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

CVE-2021-36203

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

Cross site request forgery (csrf)

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

CVE-2021-36203 Johnson Controls Metasys SCT Pro

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

CVE-2021-36203

Summary of CVE-2021-36203 (Johnson Controls Metasys SCT/SCT Pro SSRF) : The vulnerability is a server-side request forgery (SSRF) that can let an attacker identify and forge requests to internal systems via a specially crafted request. Affected products: Metasys System Configuration Tool (SCT) an...