378 matches found
BIT-DISCOURSE-2023-28112 Discourse's SSRF protection missing for some FastImage requests
Discourse is an open-source discussion platform. Prior to version 3.1.0, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This...
USN-6643-1 node-ip vulnerability
Emre Durmaz discovered that NPM IP package incorrectly distinguished between private and public IP addresses. A remote attacker could possibly use this issue to perform Server-Side Request Forgery SSRF attacks...
USN-6643-1: NPM IP vulnerability
Emre Durmaz discovered that NPM IP package incorrectly distinguished between private and public IP addresses. A remote attacker could possibly use this issue to perform Server-Side Request Forgery SSRF attacks...
NPM IP package incorrectly identifies some private IP addresses as public
The isPublic function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery SSRF if isPublic is used to...
Multiple out-of-bounds write vulnerabilities in Canon Office/Small Office Multifunction Printers and Laser Printers
Overview Office/Small Office Multifunction Printers and Laser Printers provided by Canon Inc. contain multiple out-of-bounds write vulnerabilities CWE-787, CVE-2023-6229, CVE-2023-6230, CVE-2023-6231, CVE-2023-6232, CVE-2023-6233, CVE-2023-6234, CVE-2024-0244. Canon Inc. reported these...
CVE-2023-35838
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while...
PT-2023-6277
Name of the Vulnerable Software and Affected Versions WireGuard client version 0.5.3 Description The issue is related to errors in handling links, allowing a remote attacker to block IP traffic to selected IP addresses. This can be exploited to trick the victim into blocking IP traffic to chosen ...
Clario VPN client security vulnerability
Clario VPN client is a VPN client for Mac from Clario. A security vulnerability exists in Clario VPN client macOS version 5.9.1.1662, which originates when the VPN client insecurely configures the operating system so that traffic to the local network is sent outside of the VPN tunnel in cleartext...
WireGuard Security Vulnerabilities
WireGuard is an open source VPN program and protocol from the individual developer Jason A. Donenfeld. A security vulnerability exists in WireGuard version 0.5.3 that originates from an insecure configuration of the operating system and firewall that results in the blocking of traffic to a local...
K58243048: Considerations for transferring files from F5 devices
Security Advisory Description The BIG-IP system uses Secure Vault, a secure SSL-encrypted storage system, to securely store sensitive data such as SSL key passphrases, users, and administrator and services passwords. However, files transferred from an F5 device including products listed in the...
Server-Side Request Forgery (SSRF)
github.com/hakobe/paranoidhttp is vulnerable to Server-Side Request Forgery. The vulnerability exists due to the ip.To4 parameter in the safeAddr function of client.go, as the library matches :: to the 127.0.0.1 address, but lacks filtering of private address, which allows a remote attacker to...
Authorization
D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. Information Disclosure – file contains a URL with private IP at line 15 "login.asp" A. The window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ; "admin" – contains defaul...
Metasploit Weekly Wrap-Up
Capture Plugin Capturing credentials is a critical and early phase in the playbook of many offensive security testers. Metasploit has facilitated this for years with protocol-specific modules all under the auxiliary/server/capture. Users can start and configure each of these modules individually,...
Server-Side Request Forgery (SSRF) in chocobozzz/peertube
Description First of all, Thanks to my friend Haxatron for his excellent report I read the fix commit, and I found out that the code only Checked the IP addresses and didn't check the domain names that refer to a private IP address Steps to reproduce first, set up a local server at 127.0.0.2:8000...
Server-Side Request Forgery (SSRF) in rodber/chevereto-free
Description There was some hardening done previously against private IP addresses in the SSRF vulnerability I disclosed in the previous report https://github.com/rodber/chevereto-free/. However the checks can be bypassed by URL redirection. Proof of Concept If http://example.com resolves to a...
Server-Side Request Forgery in ssrf-agent
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...
CVE-2021-23718
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...
Server side request forgery (ssrf)
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...
CVE-2021-23718 Server-side Request Forgery (SSRF)
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery SSRF via the defaultIpChecker function. It fails to properly validate if the IP requested is private...