Server side request forgery (ssrf)

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Skipper 代码问题漏洞

Skipper is an HTTP router and reverse proxy for service portfolios. A security vulnerability exists in Zalando Skipper version v0.13.236 that stems from vulnerability to server-side request forgery SSRF attacks...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF) via the X-Skipper-Proxy header. Multiple sources (Red Hat, OSV, ExploitDB, GHSA advisory) describe an SSRF condition allowing an attacker to access internal endpoints (e.g., AWS metadata) by sending requests with a craf...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

PT-2022-24469 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to v0.13.237 Description: The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Prox...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Cross-site Scripting (XSS)

github.com/zalando/skipper is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to bypass a query predicate via a maliciously crafted request...

Query predicate bypass in Zalando Skipper

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

GHSA-QX2J-85Q5-FFP8 Query predicate bypass in Zalando Skipper

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

Cross site request forgery (csrf)

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

CVE-2022-34296 affects the Zalando Skipper HTTP router/reverse proxy. In Skipper versions before 0.13.218, a flaw allows bypass of a query predicate via a prepared request, due to insufficient escaping/validation of application query predicates. This could enable an attacker to bypass predicate c...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

PT-2022-22112 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to 0.13.218 Description: A query predicate could be bypassed via a prepared request. Recommendations: For versions prior to 0.13.218, update to version 0.13.218 or later to resolve the issue...

Securing REST with free API Firewall. How-to guide

In our modern world, web applications are becoming ever more important. Bad actors know this and they target them more frequently than ever before. This is not likely to stop any time soon as the number of web applications the world needs will only go up with its reliance on technology. To fully...

creativefactory.zalando.de Open Redirect vulnerability

Open Bug Bounty ID: OBB-692829 Description| Value ---|--- Affected Website:| creativefactory.zalando.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

zalando.de XSS vulnerability

Open Bug Bounty ID: OBB-572262 Description| Value ---|--- Affected Website:| zalando.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...