BIT-VAULT-2023-6337 Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of...

BIT-SUITECRM-2023-6388 Suite CRM v7.14.2 - SSRF

Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF...

BIT-REDASH-2020-12725

Havoc Research discovered an authenticated Server-Side Request Forgery SSRF via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding...

BIT-GRAFANA-2020-13379

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network th...

BIT-DJANGO-2021-44420

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths...

Insecure Handling Of HTTP Requests

tomphttp/bare-server-node is vulnerable to Insecure handling of HTTP requests. The vulnerability is due to improper validation or sanitization of incoming HTTP requests, potentially allowing attackers to manipulate web traffic or perform other malicious activities...

Moderate: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body up to 1GiB, causing the receiver to fail reading the response, possibly leading to a Denial of Servic...

Moderate: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: golang: net/http/internal: Denial of Service DoS via Resource Consumption via HTTP requests CVE-2023-39326 golang: cmd/go: Protocol Fallback when fetching modules CVE-2023-45285 For more details about the security...

ALSA-2024:1131 Moderate: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: golang: net/http/internal: Denial of Service DoS via Resource Consumption via HTTP requests CVE-2023-39326 golang: cmd/go: Protocol Fallback when fetching modules CVE-2023-45285 For more details about the security...

PT-2024-2129 · Ibm · Ibm Security Verify Privilege On-Premises

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Privilege On-Premises version 11.5 Description: The issue is related to inadequate access control in the software, which could allow a remote attacker to disclose sensitive information using a specially crafted HTTP reques...

CVE-2024-0403

Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF...

Server side request forgery (ssrf)

Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF...

Dassault Systèmes 3DEXPERIENCE Security Vulnerability

Dassault Systèmes 3DEXPERIENCE is a business and innovation platform from Dassault Systèmes, France. A security vulnerability exists in 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight, and CATIA Composer, which stems from the presence of an operating system command injection vulnerability, where a...

CVE-2024-0403 Recipes 1.5.10 - Blind SSRF

Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF...

CVE-2024-0403

CVE-2024-0403 affects Recipes version 1.5.10, where the server allows arbitrary HTTP requests due to a Server-Side Request Forgery (SSRF) vulnerability. The issue enables the server to be used to contact external resources (e.g., “arbitrary HTTP requests”) and is cataloged with a CVSSv3.1 base sc...

Moderate: Red Hat Security Advisory: go-toolset-1.19-golang security update

An update for go-toolset-1.19-golang is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2024-18447 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.8 Mattermost versions 9.2.x through 9.2.4 Mattermost version 9.3.0 Mattermost versions 9.4.x through 9.4.1 Description: The issue allows an authenticated attacker to cause the server to run out of memory...

SuiteCRM Code Issue Vulnerability (CNVD-2024-28187)

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM version 7.14.2 that stems from the product's failure to properly validate user input and can be exploited by an attacker to send arbitrary HTTP requests through a vulnerable...

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body up to 1GiB, causing the receiver to fail reading the response, possibly leading to a Denial of Servic...