14 matches found
CVE-2026-55428
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...
ROS-20260708-73-0029
The vulnerability of the Auth Proxy function of the Grafana monitoring and logging platform relates to the default use of addresses with a mask of /32 when using a list of allowed IP addresses. Exploiting this vulnerability could allow an attacker to bypass security restrictions remotely...
TorchServe Server-Side Request Forgery vulnerability
ImpactRemote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...
PYSEC-2026-554 TorchServe vulnerable to bypass of allowed_urls configuration
Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...
TorchServe vulnerable to bypass of allowed_urls configuration
ImpactTorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effective...
CVE-2026-24048 Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the FetchUrlReader component, used by the catalog and other...
CVE-2025-53880
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list o...
EUVD-2025-36998
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list o...
CVE-2025-59778
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-59778
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-59778 VELOS partition container network vulnerability
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
F5 F5OS 安全漏洞
F5 F5OS is a proprietary operating system that runs on F5 Corporation's F5 appliances to support its Application Delivery Control and Security Performance features. A security vulnerability exists in F5 F5OS that stems from undisclosed traffic when configuring the Allowed IP Addresses feature cou...
DEBIAN-CVE-2022-43515
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...
