13686 matches found
CVE-2023-51441 Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
UNSUPPORTED WHEN ASSIGNED Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis...
CVE-2024-21642
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery SSRF, allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off ...
GHSA-7HFX-H3J3-RWQ4 D-Tale server-side request forgery through Web uploads
Impact Users hosting D-Tale publicly can be vulnerable to server-side request forgery SSRF allowing attackers to access files on the server. Patches Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn...
D-Tale server-side request forgery through Web uploads
Impact Users hosting D-Tale publicly can be vulnerable to server-side request forgery SSRF allowing attackers to access files on the server. Patches Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn...
CVE-2024-21642 D-Tale server-side request forgery through Web uploads
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery SSRF, allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off ...
CVE-2024-21642 D-Tale server-side request forgery through Web uploads
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery SSRF, allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off ...
CVE-2024-21642
D-Tale (Man Group) is affected by CVE-2024-21642. Prior to version 3.9.0, hosting D-Tale publicly can enable server-side request forgery (SSRF) via the Load From the Web feature, allowing access to server files. The fix is to upgrade to version 3.9.0, where this input is disabled by default. A wo...
Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets
CVE-2023-27163 !WARNING This is an educational projec...
Attacks, Vulnerabilities and Actors 25 December to 31 December 2023
For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, four instances of adversary activity, and five exploited...
Server Side Request Forgery
github.com/gravitational/teleport is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused due to lack of proper validation or restrictions of the destinations for SSH connections initiated through the proxy or agents. This allows an authenticated user with valid credentials...
Happy Addons for Elementor < 3.10.0 - Contributor+ SSRF
Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services...
GHSA-HW4X-MCX5-9Q36 Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users
Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact An authenticated...
Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users
Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact An authenticated...
Arbitrary remote code execution within `wrangler dev` Workers sandbox
Impact The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run...
GHSA-F8MP-X433-5WPF Arbitrary remote code execution within `wrangler dev` Workers sandbox
Impact The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run...
Zero-Day Authentication Bypass Exploit in Apache OFBiz
Summary: CVE-2023-51467 is a critical authentication bypass vulnerability in Apache OFBiz. Exploitation of this vulnerability could result in bypass authentication to achieve a simple Server-Side Request Forgery SSRF or arbitrary code execution. Users are advised to update to Apache OFBiz version...
GitLab 12.0 < 14.5.4 / 14.6 < 14.6.4 / 14.7 < 14.7.1 (CVE-2022-0249)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked. CVE-2022-0249 Note that Nessus...
GitLab 10.5 < 14.5.4 / 14.6 < 14.6.4 / 14.7 < 14.7.1 (CVE-2022-0136)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. CVE-2022-0136 Not...
GitLab < 15.4.6 (CVE-2022-4335)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host. CVE-2022-433...