CVE-2022-47873

CVE-2022-47873 affects Netcad KEOS 1.0. The vulnerability is an XML External Entity (XXE) issue that can lead to Server-Side Request Forgery (SSRF) with remote XXE. The CVSS v3.1 metrics indicate a critical impact: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8. Connected sources c...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0552)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0552 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

CVE-2022-47873

Netcad KEOS 1.0 is vulnerable to XML External Entity XXE resulting in SSRF with XXE remote...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0554)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0554 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update

A patch is now available for Camel for Spring Boot 3.14.5. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS bas...

Paranoidhttp Server-Side Request Forgery vulnerability

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

GHSA-V9MP-J8G7-2Q6M Paranoidhttp Server-Side Request Forgery vulnerability

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

Withdrawn: safeurl-python contains Server-Side Request Forgery

Withdrawn This advisory has been withdrawn as a duplicate of GHSA-jgh8-vchw-q3g7. Original Description isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

CVE-2023-24622

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

CVE-2023-24623

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

Server side request forgery (ssrf)

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

PYSEC-2023-298

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

Design/Logic Flaw

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

CVE-2023-24623

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

CVE-2023-24622

CVE-2023-24622 affects the safeurl-python package (Python) prior to 1.2. The vulnerability stems from an insufficiently restrictive regular expression in isInList for external domains, enabling server-side request forgery (SSRF). Multiple sources (NVD, Red Hat, OSV, PRION, others) corroborate the...

CVE-2023-24623

CVE-2023-24623 affects paranoidhttp before 0.3.0. The SSRF flaw arises because [::] is equivalent to 127.0.0.1 but the private-address filter is not applied, allowing unintended requests to internal resources. Public references in connected docs confirm the vulnerability and its description acros...

CVE-2023-24623

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

CVE-2023-24622

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

CVE-2023-24623

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

CVE-2022-4201

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner...