CVE-2024-51408

AppSmith Community before version 1.46 is vulnerable to SSRF via the New DataSource feature when making application/json requests to 169.254.169.254 to retrieve AWS metadata credentials. This can allow an attacker to trigger internal requests and access sensitive AWS metadata information. Root ca...

CVE-2024-51408

AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials...

PT-2024-34622 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: AppSmith Community versions 1.8.3 through 1.46 Description: The issue allows for Server-Side Request Forgery SSRF via the New DataSource feature for application/json requests to the IP address 169.254.169.254, which is used to retrieve AWS...

Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

CVE-2023-51701

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks...

CVE-2022-41919

A Cross-site request forgery CSRF vulnerability was found in fastify due to improper handling of incorrect Content-Types. This flaw allows an attacker to use an incorrect 'Content-Type' to bypass checks to allow fetch requests that could be used to invoke routes that only accept application/json...

Cross Site Request Forgery in Create a Memo Functionality (POST /api/memo)

Description I have discovered in Memos a CSRF Vulnerability in Create a Memo Functionality POST /api/memo. I have identified that it is possible to manipulate the actions of authenticated users by tricking them into clicking on a malicious link or visiting a malicious website while they are logge...

CVE-2022-29534

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

Wappointment < 2.2.5 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise the name parameter when booking an appointment, leading to a Stored Cross-Site Scripting issue which is triggered when an admin view the Calendar. PoC POST /wp-json/wappointment/v1/services/booking HTTP/1.1 Content-Length: 205 Accept: application/json, text/plain, /...

Logitech: CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]

Hey there, I have found that the api/v6/viewer-portal/viewer-settings/donationsettings endpoint is vulnerable to csrf attack, which allows an attacker to update victim's donationsettings like username,amount...

Cross-Site Scripting (XSS)

prestashop/productcomments is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via various parameters within the application. The vulnerability exists as the content-type of the server response is not set to...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html i...

Cross-Site Request Forgery (CSRF)

webargs is vulnerable to cross-site request forgery CSRF. The Content-Type header resolves to application/json when JSON input is received. If the request body is valid JSON, the application accepts it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST reques...

Stripo Inc: No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address

Summary: There's no CSRF protection in confirmation email resending feature as a result of which an attacker can trick the victim to receive a confirmation email unknowingly. In other features of the website, the content-type must be "application/json", and there is same-origin policy, which...

Denial of Service vulnerability with large JSON payloads in fastify

Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload. Recommendation Update to version 0.38.0 or later...

Fastify Denial of Service Vulnerability

Fastify is a web framework used in Node.js. A security vulnerability exists in Fastify versions prior to 0.38.0. An attacker can cause a denial of service by sending a request and payload with 'Content-Type: application/json'...

CVE-2018-3711

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload...

CVE-2018-3711

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload...

CVE-2018-3711

CVE-2018-3711 affects the Fastify node module prior to 0.38.0. A vulnerability allows a denial-of-service by sending a request with Content-Type: application/json and a very large payload, potentially making the service unresponsive. The issue is triggered by processing large JSON payloads; no ex...

QIWI: Imformation Disclosure on id.rapida.ru

Привет, Происходит раскрытие путей на id.rapida.ru/dp.php Шаги для воспроизведения: 1 Перейти на https://id.rapida.ru/login 2 Попробовать авторизоваться через телефон, ожидая смс-код. 3 Попробовать ввести не рабочий смс кодлюбой 4 В респонсе можно увидеть пути HTTP/1.1 200 OK Server: nginx Date:...