294 matches found
Server-Side Request Forgery in private-ip
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
GHSA-43CH-2H55-2VJ7 Server-Side Request Forgery in private-ip
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Server-Side Request Forgery (SSRF) in frenchbread/private-ip
✍️ Description Private-ip is an NPM module that is used to check if the input IP address is private or not, so as to prevent SSRF attacks. It has 12k downloads every week on NPM However, I found that by crafting a malicious IP, an attacker can easily bypass this check. 🕵️♂️ Proof of Concept First...
Security Bulletin: Netcool Operations Insights - Private IP Address Disclosed
Summary It was observed that the private IP address was disclosed in HTTP responses. Although various methods exist by which an attacker can determine the public IP addresses in use by an organization, the private addresses used internally cannot usually be determined in the same ways...
Connect to Veeam Backup for AWS appliance using private IP
Challenge You want to connect to a Veeam Backup for AWS appliance using its private IP. Solution If you want to connect to an appliance deployed in AWS Marketplace, use the instructions provided in Connecting to Existing Veeam Backup for AWS Appliances. At the Connection Type step of the wizard,...
Mozilla: DoH did not filter IPv4 mapped IP Addresses
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding...
Server-Side Request Forgery (SSRF)
private-ip is vulnerable to server-side request forgery SSRF. An application using the library allows an attacker to bypass the insecure regular expressions used to validate IP addresses, and perform requests on behalf of the server...
CVE-2020-28360
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Code injection
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
CVE-2020-28360
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
CVE-2020-28360
CVE-2020-28360 describes an SSRF vulnerability in the npm package private-ip (versions 1.0.5 and earlier). The root cause is an insufficient RegEx filter for reserved IP ranges, allowing an attacker to craft requests to ARIN/other reserved ranges, which can lead to remote server-side resource req...
Frenchbread Private-ip Code Issue Vulnerability
Frenchbread Private-ip is a Js codebase for checking if an Ip is private by Frenchbread individual developers. A security vulnerability exists in the Frenchbread Private-ip package prior to v1.0.5 that stems from insufficient regular expressions to adequately filter the reserved IP range, resulti...
Mozilla Firefox 安全漏洞
Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. The FireFox product suffers from a resource management error vulnerability that...
IBM Planning Analytics Information Disclosure Vulnerability
IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A security vulnerability exists in IBM Planning Analytics version 2.0. A remote attacker could...
CVE-2020-4361
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766...
CVE-2020-4361
IBM Planning Analytics 2.0 is affected by an information-disclosure vulnerability where a remote attacker could cause private IP addresses to be exposed in HTTP responses. The issue affects the Planning Analytics Local / Workspace component of IBM Planning Analytics 2.0, with root cause described...
Kubernetes: Private IP addresses Disclosure
The following URL leaks the Private IP Addresses:- kubernetes.io/feed.xml The following Server’s Cluster RFC 1918 IP addresses were disclosed in the response: • 10.1.2.3 • 10.104.207.136 • 10.224.0.0 • 10.250.0.0 • 10.250.112.0 • 10.250.96.0 • 10.55.252.216 • 10.96.0.0 • 10.96.0.1 • 10.96.15.180 ...
CVE-2013-2683
Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitive information...
Information disclosure
Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitive information...