CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

CVE-2024-11168

CVE-2024-11168 affects CPython’s urllib.parse.urlsplit/urlparse, where bracketed hosts ([]) were not validated per RFC 3986, allowing non-IPv6/Future hosts and potentially enabling SSRF if a URL is processed by multiple parsers. Affected components are the Python standard library’s URL parsing fu...

CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

PSF-2024-13

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

CVE-2024-11168

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

CVE-2024-49521

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could...

CVE-2024-49521 Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could...

CVE-2024-49521 Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could...

CVE-2024-49521

CVE-2024-49521 affects Adobe Commerce 3.2.5 and earlier . The vulnerability is a Server-Side Request Forgery (SSRF) that could enable a low-privileged attacker to issue crafted requests from the vulnerable server to internal systems, potentially bypassing security controls such as firewalls. Expl...

Reliance On Untrusted Inputs In A Security Decision

Sinatra is vulnerable to Reliance on Untrusted Inputs in a Security Decision. The vulnerability is due to improper handling of the X-Forwarded-Host header via the X-Forwarded-Host header, allowing attackers to exploit Open Redirect Attacks, Cache Poisoning, or Routing-based SSRF through untrusted...

CVE-2024-47590

An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser XXS or transmitted to...

CVE-2024-51785

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-51785

CVE-2024-51785 is a reported Server-Side Request Forgery (SSRF) vulnerability affecting the WordPress plugin Responsive Filterable Portfolio (RFP). Public detail indicates the issue affects versions from “n/a through 1.0.22” and was mitigated by a patch to at least 1.0.22. Multiple connected sour...

CVE-2024-51785 WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through = 1.0.22...

CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-50811

hopetree izone lts c011b48 contains a server-side request forgery SSRF vulnerability in the active push function as \apps\tool\apis\bdpush.py does not securely filter user input through pushurls and geturls...

CVE-2024-47190

Northern.tech Hosted Mender before 2024.07.11 allows SSRF...

CVE-2024-46947

Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF...

CVE-2024-50811

The CVE-2024-50811 entry concerns hopetree izone lts, version c011b48, which contains a server-side request forgery (SSRF) in the active push function. The vulnerability is caused by inadequate input filtering in the internal functions push_urls() and get_urls() within apps/tool/apis/bd_push.py, ...