[SECURITY] [DSA 5967-1] php8.2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5967-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 28, 2025 https://www.debian.org/security/faq -...

CVE-2025-24485

A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2025-24485

MedDream PACS Premium 7.3.5.860 is affected by CVE-2025-24485: a pre-auth SSRF in cecho.php that lets an unauthenticated attacker craft HTTP requests to influence an Association object and potentially map internal hosts via fsockopen, as detailed by Talos (CVE-2025-24485, CVSS ~5.8). Talos provid...

CVE-2025-24485

A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2025-24485

A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p4hc-9pjh-55c8. This link is maintained to preserve external references. Original Description Versions of the package ssrfcheck below 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete...

GHSA-C2FV-2FMJ-9XRX Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p4hc-9pjh-55c8. This link is maintained to preserve external references. Original Description Versions of the package ssrfcheck below 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete...

Server-Side Request Forgery (SSRF)

private-ip is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient input validation due to the failure to treat multicast IP addresses 224.0.0.0/4 as private, allowing attackers to bypass protections and make unauthorized requests...

CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 Multicast as invalid. This oversight allows attackers to craf...

CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 Multicast as invalid. This oversight allows attackers to craf...

CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 Multicast as invalid. This oversight allows attackers to craf...

CVE-2025-8267

CVE-2025-8267 affects the Python/JS package ssrfcheck prior to 1.2.0, with an incomplete IP denylist failing to classify 224.0.0.0/4 (Multicast) as invalid. This enables SSRF against multicast addresses via crafted requests. Public references from Red Hat, HTC OSV, GHSA, NVD, and PT-2025-31048 co...

CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 Multicast as invalid. This oversight allows attackers to craf...

Server-Side Request Forgery (SSRF)

Apache Ranger is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation due to the Edit Service Page in the UI allowing crafted requests that can trigger unintended internal or external network calls...

PT-2025-31048

Name of the Vulnerable Software and Affected Versions ssrfcheck versions prior to 1.2.0 Description The package is vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 Multicast a...

PT-2025-31100 · Unknown · Meddream Pacs Premium

Name of the Vulnerable Software and Affected Versions: MedDream PACS Premium version 7.3.5.860 Description: A server-side request forgery issue exists in the cecho.php functionality. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger...

Debian dla-4254 : libapache2-mod-php7.4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4254 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4254-1 [email protected]...

MedDream PACS Premium cecho.php SSRF vulnerability

Talos Vulnerability Report TALOS-2025-2177 MedDream PACS Premium cecho.php SSRF vulnerability July 28, 2025 CVE Number CVE-2025-24485 SUMMARY A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can...

Debian dsa-5967 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5967 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5967-1 [email protected] https://www.debian.org/securit...

CVE-2025-52453

Server-Side Request Forgery SSRF vulnerability in Salesforce Tableau Server on Windows, Linux Flow Data Source modules allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19...