GHSA-5P4M-2WFM-XMQJ vulnerabilities

Vulnerabilities for packages: ts-patch, kibana, eslint, lerna, commercial-gitlab-rails-ee, argo-workflows, awx, code-server, opensearch-dashboards, authentik-fips, redisinsight, opensearch-dashboards-fips, unleash-proxy, homepage, unleash-fips, vitess, langfuse-fips, authentik, wazuh-dashboard,...

EUVD-2021-12796

Malware in sbrugna...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

Server side request forgery (ssrf)

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939 ArangoDB - Blind SSRF when Downloading Foxx Service from URL

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions 3.7.0 through 3.9.0-alpha.1 allow downloading a Foxx service from a publicly available URL without proper internal request filtering, enabling a highly-privileged attacker to perform blind SSRF and reach localhost. Public documents confirm the root cause as inadequate filter...

ArangoDB 代码问题漏洞

ArangoDB is a NoSQL database system from ArangoDB GmbH. A code issue vulnerability exists in ArangoDB versions v3.7.0 through v3.9.0-alpha.1, which stems from the system having a feature that downloads Foxx services from publicly available URLs, but this feature does not enforce proper filtering ...

CVE-2021-25939: Server-Side Request Forgery (SSRF)

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

PT-2022-9685

Name of the Vulnerable Software and Affected Versions ArangoDB versions v3.7.0 through v3.9.0-alpha.1 Description The issue in ArangoDB allows a highly-privileged attacker to perform blind Server-Side Request Forgery SSRF and send internal requests to localhost. This is due to a feature that...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...