Security Bulletin: A vulnerability in HashiCorp Consul affects IBM Robotic Process Automation and may result in server-side request forgery (CVE-2022-29153).

Summary A vulnerability in HashiCorp Consul affects IBM Robotic Process Automation and may result in server-side request forgery. This bulletin identifies the security fix to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-29153 DESCRIPTION: HashiCorp Consul and HashiCorp...

Security Bulletin: Multiple security vulnerabilities in IBM MQ affect IBM Robotic Process Automation.

Summary Multiple security vulnerabilities in IBM MQ affect IBM Robotic Process Automation. This bulletin identifies the security fixes to apply to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere...

PT-2024-8548

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The HttpURI class in Eclipse Jetty does insufficient validation on the authority segment of a URI, which can lead to differences in how it handles invalid URIs compared to common...

Adobe Commerce Server-Side Request Forgery Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from a server-side request forgery vulnerability that can be exploited by an attacker to cause arbitrary file system reads...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-45317

A Server-Side Request Forgery SSRF vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address...

CVE-2024-45317

A Server-Side Request Forgery (SSRF) vulnerability exists in the SonicWALL SMA1000 appliance firmware, specifically affecting versions 12.4.3-02676 and earlier . This flaw allows a remote, unauthenticated attacker to compel the SMA1000 server-side application to perform requests to unintended IP ...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

CVE-2024-47830: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

PYSEC-2024-215

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

GHSA-576C-3J53-R9JJ Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

CVE-2024-47167

CVE-2024-47167 affects Gradio (Python) and describes a Server-Side Request Forgery (SSRF) in the /queue/join endpoint via async_save_url_to_cache, allowing an attacker to cause the Gradio server to fetch HTTP requests from user-controlled URLs. This can enable targeting internal services within a...

CVE-2024-47167 SSRF in the path parameter of /queue/join in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

SonicWall SSL-VPN SMA1000 and Connect Tunnel Windows Client Affected By Multiple Vulnerabilities

1 CVE-2024-45315 - SonicWALL SMA1000 Connect Tunnel Windows Client Link Following Denial-of-Service VulnerabilityThe Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard...

GHSA-G9FM-WC6H-PVGJ Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection ...

CVE-2024-8977

CVE-2024-8977 describes a Server‑Side Request Forgery (SSRF) in GitLab EE affecting versions from 15.10 up to 17.2.9, 17.3 up to 17.3.4, and 17.4 up to 17.4.2 when the Product Analytics Dashboard is configured and enabled. The vulnerability is exploitable over the network with no user interaction...