CVE-2024-8635 Server-Side Request Forgery (SSRF) in GitLab

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy UR...

CVE-2024-8635 Server-Side Request Forgery (SSRF) in GitLab

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy UR...

TotalCloud Insights: Unmasking AWS Instance Metadata Service v1 (IMDSv1)-The Hidden Flaw in AWS Security

Introduction Imagine a breach that cost a company over $150 million in fines, remediation, and lost trust. In 2019, this was an all-too-real situation for one business when vulnerabilities in AWS Instance Metadata Service v1 IMDSv1 were exploited. A single Server-Side Request Forgery SSRF attack,...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability in GitLab EE versions 16.8 to before 17.1.7, 17.2 to...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2024-2417)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services,...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2024-2440)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services,...

EulerOS 2.0 SP9 : httpd (EulerOS-SA-2024-2368)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services,...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2024-2440)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

LangChain Python Library < 0.0.317 (CVE-2023-46229)

LangChain is a framework for developing applications powered by large language models. LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server. Note that Nessus has not tested for this issue but has...

Gitlab -- vulnerabilities

Gitlab reports: Execute environment stop actions as the owner of the stop action job Prevent code injection in Product Analytics funnels YAML SSRF via Dependency Proxy Denial of Service via sending a large glmsource parameter CIJOBTOKEN can be used to obtain GitLab session token Variables from...

CVE-2024-44677

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery SSRF which allows an attacker to execute arbitrary code via the DatabaseController.java component...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

CVE-2023-37229

Loftware Spectrum before 5.1 allows SSRF...

CVE-2023-37229

Loftware Spectrum before 5.1 allows SSRF...

CVE-2024-44677

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery SSRF which allows an attacker to execute arbitrary code via the DatabaseController.java component...

CVE-2023-37229

Loftware Spectrum before 5.1 allows SSRF...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

CVE-2023-37229

CVE-2023-37229 concerns Loftware Spectrum and is described as a server-side request forgery (SSRF) vulnerability present in versions prior to 5.1. The Red Hat, NVD, CVE listings all reiterate that Loftware Spectrum before 5.1 is affected by SSRF. The PT-Security entry confirms the issue is SSRF a...

CVE-2024-44677

Summary (CVE-2024-44677) eladmin v2.7 and earlier is vulnerable to Server-Side Request Forgery (SSRF) via the DatabaseController.java component, enabling an attacker to execute arbitrary code. This aligns with Red Hat and CVE records describing a high-severity, network-based impact with no privil...

CVE-2023-37230

Loftware Spectrum's testDeviceConnection vulnerability (CVE-2023-37230) is an SSRF issue in versions prior to 5.1. The CVSS 3.1 score is 8.8 (High) with network attack, no privileges, user interaction required, and impacts to confidentiality, integrity, and availability. The provided sources conf...