13434 matches found
CVE-2024-48052
CVE-2024-48052 affects gradio
CVE-2024-48052
In gradio =4.42.0, the gr.DownloadButton function has a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resourc...
CVE-2024-21510
A flaw was found in Sinatra. This vulnerability allows an Open Redirect attack via the X-Forwarded-Host XFH header, potentially enabling Cache Poisoning or Server-Side Request Forgery SSRF when used in caching servers or reverse proxies...
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
GHSA-HXX2-7VCW-MQR3 Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
DEBIAN-CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
CVE-2024-21510
CVE-2024-21510 affects Sinatra (Ruby): versions of the package sinatra from 0.0.0 are vulnerable. The issue arises from reliance on untrusted inputs via the X-Forwarded-Host header, enabling an Open Redirect when a request with a redirect is made. If such a header is used for caching (e.g., with ...
CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
Server Side Request Forgery(SSRF) on WordExtractor in langgenius/dify
Summary The vulnerability occurs when uploading DOCX files in the "Create Knowledge" section. If an external relationship exists in the DOCX file, the reltype value is requested as a URL. Requests are sent using the 'requests' module instead of the 'ssrfproxy', which can lead to an SSRF...
WordPress Magical Addons For Elementor Plugin <= 1.2.1 is vulnerable to Server Side Request Forgery (SSRF)
Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-51665 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 7e66dec39a19 Credits João...
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...
CVE-2024-48360
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php...
SSRF due to insufficient patch of CVE-2024-5822
This report is not public...
PT-2024-33091 · Qualitor · Qualitor
Name of the Vulnerable Software and Affected Versions: Qualitor versions 8.24 and below Description: The issue is related to a Server-Side Request Forgery SSRF in the component /request/viewValidacao.php. This allows for an unauthenticated server-side request forgery vulnerability. Recommendation...
CVE-2024-48360
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php...
Qualitor 8.24 Server-Side Request Forgery
CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our team identified a vulnerability in the application...
CVE-2024-48360
Qualitor ≤ v8.24 is affected by an unauthenticated Server-Side Request Forgery via /request/viewValidacao.php. The vulnerability (CVE-2024-48360) allows forcing the server to make arbitrary requests, potentially probing internal resources. CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5)....