108 matches found
CVE-2024-38206
Microsoft Copilot Studio contains CVE-2024-38206: an authenticated attacker can bypass SSRF protections to leak sensitive information over the network. Affected product: Microsoft Copilot Studio. Root cause per the entry is insufficient validation allowing SSRF bypass. Impact is information discl...
Microsoft Copilot Studio Information Disclosure Vulnerability
An authenticated attacker can bypass Server-Side Request Forgery SSRF protection in Microsoft Copilot Studio to leak sensitive information over a network...
CVE-2023-47116 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
Design/Logic Flaw
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
PT-2023-15810 · Jetbrains · Jetbrains Hub
Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2023.1.15725 Description: The issue concerns a missing Server-Side Request Forgery SSRF protection in the Auth Module integration. This could potentially allow for unauthorized access or actions. No information...
CVE-2023-28112
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...
CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...
CVE-2023-28111
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...
CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...
CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...
CVE-2023-28111
CVE-2023-28111 concerns Discourse prior to 3.1.0.beta3 (beta and tests-passed branches), where an attacker can bypass the platform’s SSRF protections for private IPv4 addresses by using an IPv4-mapped IPv6 address. The root cause is a weakness in SSRF filtering that permits IPv4-mapped IPv6 repre...
Discourse 3.1.x < 3.1.0.beta3 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...
Predictions for 2023 from Latest API Threat Research | API Security Newsletter
March has arrived and is roaring like a very confused lion, at least in the northern hemisphere. And much like in the wild, brood production is increasing. Weve already seen some fruits of that labor, such as the Q4-2022 and 2022 Year-End ThreatStats™ Report, and some very tasty product upgrades...
Server side request forgery (ssrf)
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record...