VulnCheck KEV: CVE-2024-6893

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...

Low: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.4 security update

Red Hat OpenShift Service Mesh Containers for 2.5.4 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2024-45302

RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to RestRequest.AddHeader the header value is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. The way HTTP headers are added to a request is via the...

CVE-2024-45302 CRLF Injection in RestSharp's `RestRequest.AddHeader` method

RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to RestRequest.AddHeader the header value is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. The way HTTP headers are added to a request is via the...

GHSA-4RR6-2V9V-WCPC CRLF Injection in RestSharp's `RestRequest.AddHeader` method

Summary The second argument to RestRequest.AddHeader the header value is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: This...

CVE-2024-45302: Improper Neutralization of CRLF Sequences

RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to RestRequest.AddHeader the header value is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. The way HTTP headers are added to a request is via the...

WordPress Justified Image Grid Plugin <= 4.6.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Justified Image Grid Type Plugin Vulnerable versions = 4.6.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-43989 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID da30806f1809 Credits Rafie Muhammad...

Exploit for CVE-2024-34351

CVE-2024-34351 Exploit - CVE-2024-34351 PoChttps://github...

Security Bulletin: Denial of service and server-side request forgery might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-39249, CVE-2024-39338 Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of...

req may send an unintended request when a malformed URL is provided

The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...

GHSA-CJ55-GC7M-WVCQ req may send an unintended request when a malformed URL is provided

The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...

PT-2024-31514 · Req · Req

Name of the Vulnerable Software and Affected Versions: req package versions prior to 3.43.4 Description: The req package may send an unintended request when a malformed URL is provided, due to the cleanHost function in http.go using a "garbage in, garbage out" design. This can lead to security...

GO-2022-0583 Server-Side Request Forgery in gogs webhook in gogs.io/gogs

Server-Side Request Forgery in gogs webhook in gogs.io/gogs...

GO-2022-0585 Server-Side Request Forgery in Apache Traffic Control in github.com/apache/trafficcontrol

Server-Side Request Forgery in Apache Traffic Control in github.com/apache/trafficcontrol...

GO-2022-0449 Server-Side Request Forgery in charm in github.com/charmbracelet/charm

Server-Side Request Forgery in charm in github.com/charmbracelet/charm...

CVE-2024-43371

CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their...

CVE-2024-43371

CVE-2024-43371 describes a Server Side Request Forgery (SSRF) in CKAN via multiple plugins (XLoader, DataPusher, Resource proxy, ckanext-archiver) that fetch remote resources without validating the target URL. The underlying issue is that these plugins use the resource URL without restricting des...

WordPress Skitter Slideshow Plugin <= 2.5.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Skitter Slideshow Type Plugin Vulnerable versions = 2.5.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-1751 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 248ddea6bcba Credits Bartu Utku SARP Required...

CVE-2022-1751 Skitter Slideshow <= 2.5.2 - Unauthenticated Server-Side Request Forgery

The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and ca...

CVE-2022-1751

The CVE-2022-1751 entry concerns the WordPress Skitter Slideshow plugin (versions up to and including 2.5.2). A Server-Side Request Forgery (SSRF) flaw exists via the /image.php endpoint, allowing unauthenticated attackers to issue web requests from the web application to arbitrary internal resou...