10331 matches found
WireMock Controlled Server Side Request Forgery vulnerability through URL
Impact WireMock can be configured to only permit proxying and therefore recording to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Documentation. Until WireMock Webhooks Extension 3.0.0-beta-1...
CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...
CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...
CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...
CVE-2023-41327 Controlled SSRF through URL in the WireMock
WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying and therefore recording to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhook...
CVE-2023-41327
CVE-2023-41327: WireMock Webhooks could forward webhook POSTs to arbitrary targets due to improper filtering of proxy targets prior to versions 2.35.1 and 3.0.3. Affected: WireMock (2.x up to 2.35.1, 3.x up to 3.0.3) and WireMock Studio (discontinued). Root cause: Webhook configuration allowed re...
CVE-2023-41329 Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio
WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a ca...
WireMock Code Issue Vulnerability
WireMock is a popular open source tool for API mock testing open source by WireMock. A code issue vulnerability exists in WireMock that stems from the fact that when certain request URLs are used in WireMock Studio configuration fields, the request may be forwarded to an arbitrary service...
PT-2023-6522
Name of the Vulnerable Software and Affected Versions WireMock versions prior to 2.35.1 WireMock versions prior to 3.0.3 Python WireMock versions prior to 2.6.1 WireMock Studio all versions Description The issue is related to the proxy mode of WireMock, which can be protected by network...
PT-2023-27179 · Unknown · Wiremock Studio
Name of the Vulnerable Software and Affected Versions: WireMock Studio affected versions not specified Description: WireMock is a tool for mocking HTTP services. When certain request URLs like "@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an...
"Connection Interrupted" error message will pop up when trigger disconnect from director or studio
• "Connection Interrupted"error message will pop up when admin user trigger disconnect from director or studio • If user directly click disconnect from toolbar or × ， issue won’t happen • Issue only happen for random users , not all users have this issue...
Tiny_Tracer - A Pin Tool For Tracing API Calls Etc
A Pin Tool for tracing: API calls, including parameters of selected functions selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between sections of the traced module helpful in finding OEP of the packed module Bypasses the...
Information Disclosure
@apollo/server and apollo-server-core are vulnerable to Information Disclosure. The vulnerability is due to a lack sensitive information masking such as Studio API keys which can end up getting logged if they are passed incorrectly with leading/trailing whitespace or if they have any invalid...
CVE-2023-36088
Server Side Request Forgery SSRF vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information...
Server side request forgery (ssrf)
Server Side Request Forgery SSRF vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information...
PT-2023-25425 · Unknown · Nebulagraph Studio
Name of the Vulnerable Software and Affected Versions: NebulaGraph Studio version 3.7.0 Description: The issue allows remote attackers to gain sensitive information due to a Server Side Request Forgery SSRF vulnerability. Recommendations: For NebulaGraph Studio version 3.7.0, at the moment, there...
CVE-2023-36088
NebulaGraph Studio 3.7.0 is affected by a Server Side Request Forgery (SSRF) vulnerability. Connected sources consistently describe SSRF leading to sensitive information disclosure. The exact root cause within the implementation, affected components, and a formal remediation/fix version are not d...
NebulaGraph Studio Code Issue Vulnerability
NebulaGraph Studio is a web-based graph database visualization tool from NebulaGraph, Inc. A security vulnerability exists in NebulaGraph Studio version 3.7.0 that originates from allowing remote attackers to obtain sensitive information...