Flyte Console <0.52.0 - Server-Side Request Forgery Detection

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or...

Nautobot Security Vulnerability

Nautobot is a web automation platform by the individual developers of Nautobot. A security vulnerability exists in Nautobot versions 1.1.0 through 1.6.7, prior to 2.0.6, which stems from the fact that in the default configuration used by Nautobot, URLs are accessible by default without any user...

GO-2022-1086 Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper

An attacker can access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Proxy to the http request...

PT-2022-24469 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to v0.13.237 Description: The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Prox...