CVE-2023-48910

Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-48910

Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-48910

Microcks up to version 1.17.1 is affected by a Server-Side Request Forgery (SSRF) via the /jobs and /artifact/download components. The underlying issue allows an attacker to access network resources and sensitive information through a crafted GET request. Public references across multiple sources...

CVE-2023-46746

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery SSRF, which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling...

CVE-2023-46746 Authenticated PostHog users vulnerable to SSRF

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery SSRF, which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling...

CVE-2023-46746 Authenticated PostHog users vulnerable to SSRF

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery SSRF, which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling...

CVE-2023-46746

CVE-2023-46746 concerns PostHog (self-hosted) where a server-side request forgery (SSRF) vulnerability could be exploited by authenticated users. The root cause is that PostHog did not verify whether a URL is local when enabling webhooks, allowing an authenticated user to forge a POST request. Th...

Apache Tiles: Unvalidated input may lead to path traversal and XXE

The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relativel...

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

Path traversal

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735 Apache Tiles: Unvalidated input may lead to path traversal and XXE

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

CVE-2023-49735 affects Apache Tiles (2 onward). The DefaultLocaleResolver.LOCALE_KEY value, when used to resolve XML definition files, is not validated, enabling path traversal and potentially SSRF/XXE when user-controlled data is supplied. This vulnerability is tied to Tiles usage and is noted a...

CVE-2023-49735 Apache Tiles: Unvalidated input may lead to path traversal and XXE

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-48023

Anyscale Ray 2.6.3 and 2.8.0 allows /logproxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

Code injection

Anyscale Ray 2.6.3 and 2.8.0 allows /logproxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

Server Side Request Forgery (SSRF) / XSS / File Upload

HotelDruid is vulnerable to Server Side Request Forgery SSRF / Cross Site Scripting XSS and File Upload Vulnerability. It can lead to compromising Confidentiality, Integrity and Availability of the system...

CVE-2023-48023

Anyscale Ray 2.6.3 and 2.8.0 allows /logproxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...