CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypubfederation and versions 0.19...

CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypubfederation and versions 0.19...

CVE-2025-25194

CVE-2025-25194 describes a Server-Side Request Forgery (SSRF) in Lemmy linked to the activitypub_federation Rust library. The vulnerability allows an attacker to craft a Webfinger-based request that may bypass hardcoded URL/path restrictions and trigger an arbitrary GET to any Host, Port, and URL...

GHSA-7723-35V7-QCXW Server-Side Request Forgery (SSRF) in activitypub_federation

Summary This vulnerability allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. Details The Webfinger endpoint takes a remote domain for checking accounts as a...

Server-Side Request Forgery (SSRF) in activitypub_federation

This vulnerability allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request...

Lemmy 代码问题漏洞

Lemmy is Lemmy open source free software for building social news aggregators and web forums. A code issue vulnerability exists in Lemmy 0.19.8 and earlier versions, which stems from a dependency in activitypubfederation that does not properly handle Webfinger requests, leading to server-side...

CVE-2024-43414

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1...

CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...

GO-2025-3396 Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib

Server-Side Request Forgery SSRF on redirects and federation in github.com/matrix-org/gomatrixserverlib...

GO-2025-3399 Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo

Matrix Media Repo MMR allows Server-Side Request Forgery SSRF on redirects and federation in github.com/t2bot/matrix-media-repo...

CVE-2024-52594 Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib

Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...

PT-2025-2932 · Unknown +1 · Gomatrixserverlib +1

Name of the Vulnerable Software and Affected Versions: Gomatrixserverlib affected versions not specified Description: Gomatrixserverlib is a Go library for matrix federation. It is vulnerable to server-side request forgery, serving content from a private network it can access, under certain...

CVE-2025-21193

Active Directory Federation Server Spoofing Vulnerability...

CVE-2025-21193

Active Directory Federation Server Spoofing Vulnerability...

CVE-2025-21193 Active Directory Federation Server Spoofing Vulnerability

...

CVE-2025-21193 Active Directory Federation Server Spoofing Vulnerability

...

Active Directory Federation Server Spoofing Vulnerability

...

PT-2025-1211 · Microsoft · Active Directory Federation Services +1

Name of the Vulnerable Software and Affected Versions: Active Directory Federation Server affected versions not specified Description: The issue is related to a spoofing vulnerability in the Active Directory Federation Server component of the Windows operating system, which is associated with...

Microsoft Active Directory Federation Services 跨站请求伪造漏洞

Microsoft Active Directory Federation Services is a software component of Microsoft Corporation that runs on the Windows Server operating system. It provides users with single sign-on access to systems and applications that cannot use Integrated Windows Authentication IWA through Active Directory...

SUSE CVE-2024-56513

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the karmadactl register command have excessive privileges to access control plane resources...