CVE-2024-43710

CVE-2024-43710 describes a server-side request forgery in Kibana via the /api/fleet/health_check endpoint. Affected component: Kibana; vulnerable function: internal requests triggered by the health_check API when accessed by users with read access to Fleet. In the provided documents, the CVSS 3.1...

CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...