13526 matches found
GHSA-6FCF-G3MP-XJ2X memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...
GHSA-9CQM-MGV9-VV9J memos vulnerable to Server-Side Request Forgery and Cross-site Scripting
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...
GHSA-QF3Q-9F3H-CJP9 NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint
NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using...
NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint
NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using...
CVE-2024-42352
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352
CVE-2024-42352 concerns the Nuxt icon API exposed at /api/_nuxt_icon/[name]. The issue stems from how the proxied request path is parsed, allowing an attacker to change the scheme and host of the request via the new URL constructor, which tolerates poorly formatted URLs. This can enable SSRF, pot...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
GHSA-CXGV-PX37-4MP2 Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...
@bloggrify/bento (>=0.9.1, <=0.9.4), @bloggrify/core (>=1.1.1, <=1.4.5) +62 more potentially affected by CVE-2024-34343 via nuxt (>=3.0.0, <=3.12.3)
nuxt NPM version =3.0.0, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =4.0.3, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.5.0, =1.0.0-beta.11, =1.2.0 and more Source cves: CVE-2024-34343 Source advisory: OSV:GHSA-VF6R-87Q4-2VJF...
CVE-2024-36448
Apache IoTDB Workbench is affected by a Server-Side Request Forgery (SSRF) vulnerability. Affects versions 0.13.0 and later; attackers can access the local network. The project is retired and no fix will be released; users should restrict access to trusted users or seek alternatives as a temporar...
CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...
CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...
Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
GHSA-FFXG-5F8M-H72J Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
CVE-2024-39713
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...