702 matches found
imgproxy is vulnerable to SSRF against 0.0.0.0
Summary Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. Details imgproxy protects against SSRF against a loopback address with the following check source: if !config.AllowLoopbackSourceAddresses ...
CVE-2025-24354
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2...
CVE-2025-24354 imgproxy is vulnerable to SSRF against 0.0.0.0
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2...
CVE-2025-24354
Imgproxy (CVE-2025-24354) is affected by a Server-Side Request Forgery (SSRF) due to not blocking the 0.0.0.0 address when IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES is false. This allows access to local-host services because 0.0.0.0 is not considered loopback by Go’s ip.IsLoopback() check. The iss...
CVE-2025-24354 imgproxy is vulnerable to SSRF against 0.0.0.0
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXYALLOWLOOPBACKSOURCEADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2...
CVE-2024-12345
A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...
CVE-2024-12345 INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption
A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...
CVE-2024-12345
CVE-2024-12345 affects INW Krbyyyzo 25.2002, specifically the Daily Huddle Site component. The vulnerability is in the file /gbo.aspx where tampering the argument s can cause resource consumption, enabling a local-host attack and potentially affecting other endpoints. Public sources consistently ...
CVE-2024-12345 INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption
A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack o...
PT-2025-5337 · Imgproxy +1 · Imgproxy +1
Name of the Vulnerable Software and Affected Versions: imgproxy versions prior to 3.27.2 Description: The issue concerns imgproxy, a server for resizing, processing, and converting images. It does not block the 0.0.0.0 address, even when IMGPROXY ALLOW LOOPBACK SOURCE ADDRESSES is set to false...
CVE-2025-0396
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading t...
CVE-2024-13206 REVE Antivirus reveinstall default permission
A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp/reveinstall. The manipulation leads to incorrect default permissions. It is possible to launch the attack on the local host. The exploit...
CVE-2024-13187 Kingsoft WPS Office TCC code injection
A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component TCC Handler. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit...
PT-2025-2045 · Kingsoft · Kingsoft Wps Office
Name of the Vulnerable Software and Affected Versions: Kingsoft WPS Office version 6.14.0 Description: A critical issue was found in the TCC Handler component of Kingsoft WPS Office, allowing for code injection. The manipulation can lead to an attack on the local host. The issue has been publicly...
PT-2025-25550 · Assimp +1 · Assimp +1
Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions up to 5.4.3 Description: A critical issue was found in the Open Asset Import Library Assimp. The read meshes function in the library is affected, leading to a heap-based buffer overflow. This issue ca...
Server-side Request Forgery (SSRF)
Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhos...
CVE-2024-12660
CVE-2024-12660 affects IObit Advanced SystemCare Ultimate up to 17.0.0. The vulnerability is in function 0x8001E018 of AscRegistryFilter.sys (IOCTL Handler) and causes a null pointer dereference, enabling a local-host attack. Public exploit availability is indicated, with vendor non-response note...
CVE-2024-12655 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference
A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. It is possible to launch the...
CVE-2024-12655 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference
A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. It is possible to launch the...
