CVE-2025-24354 imgproxy is vulnerable to SSRF against 0.0.0.0

imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2...

CVE-2025-24354

Imgproxy (CVE-2025-24354) is affected by a Server-Side Request Forgery (SSRF) due to not blocking the 0.0.0.0 address when IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES is false. This allows access to local-host services because 0.0.0.0 is not considered loopback by Go’s ip.IsLoopback() check. The iss...

CVE-2025-24354 imgproxy is vulnerable to SSRF against 0.0.0.0

imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2...

CVE-2024-12345

A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...

CVE-2024-12345 INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption

A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...

CVE-2024-12345

CVE-2024-12345 affects INW Krbyyyzo 25.2002, specifically the Daily Huddle Site component. The vulnerability is in the file /gbo.aspx where tampering the argument s can cause resource consumption, enabling a local-host attack and potentially affecting other endpoints. Public sources consistently ...

CVE-2024-12345 INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption

A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...

PT-2025-5337 · Imgproxy +1 · Imgproxy +1

Name of the Vulnerable Software and Affected Versions: imgproxy versions prior to 3.27.2 Description: The issue concerns imgproxy, a server for resizing, processing, and converting images. It does not block the 0.0.0.0 address, even when IMGPROXY ALLOW LOOPBACK SOURCE ADDRESSES is set to false...

CVE-2025-0396

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading t...

CVE-2024-13206 REVE Antivirus reveinstall default permission

A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp/reveinstall. The manipulation leads to incorrect default permissions. It is possible to launch the attack on the local host. The exploit...

CVE-2024-13187 Kingsoft WPS Office TCC code injection

A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component TCC Handler. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit...

PT-2025-2045 · Kingsoft · Kingsoft Wps Office

Name of the Vulnerable Software and Affected Versions: Kingsoft WPS Office version 6.14.0 Description: A critical issue was found in the TCC Handler component of Kingsoft WPS Office, allowing for code injection. The manipulation can lead to an attack on the local host. The issue has been publicly...

PT-2025-25550 · Assimp +1 · Assimp +1

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions up to 5.4.3 Description: A critical issue was found in the Open Asset Import Library Assimp. The read meshes function in the library is affected, leading to a heap-based buffer overflow. This issue ca...

Server-side Request Forgery (SSRF)

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhos...

CVE-2024-12660

CVE-2024-12660 affects IObit Advanced SystemCare Ultimate up to 17.0.0. The vulnerability is in function 0x8001E018 of AscRegistryFilter.sys (IOCTL Handler) and causes a null pointer dereference, enabling a local-host attack. Public exploit availability is indicated, with vendor non-response note...

CVE-2024-12655 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference

A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. It is possible to launch the...

CVE-2024-12655 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference

A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. It is possible to launch the...

Exploit for Command Injection in Materialsvirtuallab Pymatgen

!imagehttps://github.com/user-attac...

CVE-2024-12354

Summary: CVE-2024-12354 affects SourceCodester Phone Contact Manager System 1.0. The vulnerability is a buffer overflow in the function UserInterface::MenuDisplayStart within the User Menu component, enabling a local attacker to exploit it on the host. Multiple sources confirm the issue and indic...

CVE-2024-12227

A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLibX64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on t...