memos 安全漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which stems from /o/get/image allows an unauthenticated user to enumerate the internal network and retrieve images, with the response to the image...

memos 安全漏洞

memos is an open source hosted memos center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which originates in /api/resource and allows authenticated users to enumerate the internal network...

Server-side Request Forgery (SSRF)

gradio is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of the 'file' parameter in a GET request, enabling attackers to scan and identify open ports within an internal network by observing responses for 'Location' headers or 'File not allowed' error...

PT-2024-22683 · Memos · Memos

Name of the Vulnerable Software and Affected Versions: memos versions 0.13.2 through 0.21.x Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. It exists at the /api/resource endpoint, allowing authenticated users to enumerate the internal network...

gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

GHSA-QH6X-J82H-VPF9 gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CVE-2024-1183

Gradio (gradio-app/gradio) contains an SSRF flaw exposed via the file parameter in a GET request. The vulnerability enables an unauthenticated attacker to probe internal networks by observing responses (e.g., Location headers or “File not allowed” messages) to identify open ports. The Nuclei temp...

CVE-2024-1183 SSRF Vulnerability in gradio-app/gradio

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

Gradio 输入验证错误漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from an input validation error vulnerability that stems from the presence of a server-side request forgery vulnerability that allows an attacker to scan an...

PT-2024-17278

Name of the Vulnerable Software and Affected Versions gradio-app/gradio affected versions not specified Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to scan and identify open ports within an internal network. By manipulating the file parameter in a GET request, ...

PT-2024-7807 · Milestone Systems · Xprotect Device Pack

Name of the Vulnerable Software and Affected Versions: Siveillance Video formerly Siveillance VMS versions affected versions not specified XProtect Device Pack versions affected versions not specified Description: The issue is related to a buffer overflow vulnerability due to the lack of size...

CVE-2024-29018

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature i...

CVE-2024-29018

CVE-2024-29018 affects the Moby-based docker/libnetwork networking stack, where internal networks can forward DNS requests to an external nameserver due to how host loopback DNS resolution is bridged for internal networks. The issue enables an attacker controlling an authoritative DNS domain to c...

GHSA-MQ39-4GV4-MVPX Moby's external DNS requests from 'internal' networks could lead to data exfiltration

Moby is an open source container framework originally developed by Docker Inc. as Docker. It is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. As a batteries-included container runtime, Moby comes with a built-in networking implementati...

Moby's external DNS requests from 'internal' networks could lead to data exfiltration

Moby is an open source container framework originally developed by Docker Inc. as Docker. It is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. As a batteries-included container runtime, Moby comes with a built-in networking implementati...

GHSA-Q97G-C29H-X2P7 Whoogle Search Path Traversal vulnerability

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

Server-Side Request Forgery (SSRF)

RSSHub is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to SSRF vulnerabilities in RSSHub, enabling remote attackers to utilize the server as a proxy for sending HTTP GET requests to arbitrary targets. This could result in retrieving information from the internal networ...

GHSA-3P3P-CGJ7-VGW3 RSSHub vulnerable to Server-Side Request Forgery

Summary Serveral Server-Side Request Forgery SSRF vulnerabilities in RSSHub allow remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service DoS attacks. Details...

BIT-GITLAB-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...