66 matches found
CVE-2026-92569
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
CVE-2026-92569
Hippo4j through version 1.5.0 is affected by a server-side request forgery (SSRF) vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests toward intern...
CVE-2026-92569 Hippo4j through 1.5.0 SSRF via clientAddress Parameter
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
CVE-2026-92569 Hippo4j through 1.5.0 SSRF via clientAddress Parameter
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
CVE-2026-92569 Hippo4j through 1.5.0 SSRF via clientAddress Parameter
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
CVE-2026-92569
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
EUVD-2026-80815
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
PT-2026-93814
Name of the Vulnerable Software and Affected Versions Hippo4j versions prior to 1.5.1 Description Authenticated attackers can trigger outbound GET requests to internal networks and cloud metadata services. This occurs because four ThreadPoolController endpoints fail to validate the clientAddress...
CVE-2026-92569: Server-Side Request Forgery (SSRF)
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...
EUVD-2023-1142
Malicious code in bioql PyPI...
EUVD-2023-1028
Malicious code in bioql PyPI...
EUVD-2025-25521
Malicious code in bioql PyPI...
EUVD-2023-1004
Malicious code in bioql PyPI...
CVE-2025-51606
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...
GHSA-48CG-9C55-J2Q7 hippo4j Includes Hard Coded Secret Key in JWT Creation
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...
cn.hippo4j:hippo4j-adapter-web (>=1.4.0-alpha, <=1.5.0), cn.hippo4j:hippo4j-config-spring-boot-1x-starter (>=1.4.2, <=1.5.0) +22 more potentially affected by CVE-2025-51606 via cn.hippo4j:hippo4j-core (>=1.1.0-alpha.2, <=1.5.0)
cn.hippo4j:hippo4j-core MAVEN version =1.1.0-alpha.2, =1.4.0-alpha, =1.4.2, =1.4.0-rc, =1.1.0-alpha.2, =1.4.3, =1.4.0-alpha, =1.4.1, =1.4.0-alpha, =1.4.1, =1.4.0-alpha, =1.4.1, =1.4.0-alpha, =1.1.0-alpha.2, =1.4.0-alpha, =1.4.1, =1.5.0 and more Source cves: CVE-2025-51606 Source advisory:...
hippo4j Includes Hard Coded Secret Key in JWT Creation
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...
CVE-2025-51606
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...
CVE-2025-51606: Use of Hard-coded Credentials
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...
CVE-2025-51606
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...