10163 matches found
Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
The Migration Toolkit for Containers MTC 1.8.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Mattermost 代码问题漏洞
Mattermost is an open source collaboration platform from US-based Mattermost. A code issue vulnerability exists in Mattermost version 9.5.8, which stems from a failure to add Oracle Cloud and Alibaba metadata endpoints to the server-side request forgery denial list, resulting in vulnerability to...
httpd: SSRF in Apache HTTP Server on Windows via mod_rewrite in server/vhost context
A flaw was found in HTTPd on Windows systems. This issue potentially allows NTLM hashes to be leaked via modrewrite in server/vhost context to a malicious server via Server-side request forgery SSRF and malicious requests or content...
CVE-2024-47066
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...
CVE-2024-47066
CVE-2024-47066 (Lobe Chat) is an SSRF issue in Lobe Chat prior to version 1.19.13 where server-side proxy protection in src/app/api/proxy/route.ts does not handle redirects, allowing an attacker-supplied URL to redirect to internal resources (e.g., private networks or loopback). The vulnerability...
CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...
CVE-2024-43989
Server-Side Request Forgery SSRF vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through = 4.6.1...
CVE-2024-46984
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox...
CVE-2024-46984 XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox...
CVE-2024-46984 XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox...
CVE-2024-46984
CVE-2024-46984 affects gematik app-referencevalidator’s referencevalidator Commons profile location routine, which is vulnerable to XML External Entities (XXE) due to insecure Woodstox WstxInputFactory defaults. A malicious XML resource can induce network requests and Server-Side Request Forgery ...
CVE-2024-46984 XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox...
Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack
Impact The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a Server Side...
VulnCheck KEV: CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
CVE-2022-25777 Server-Side Request Forgery in Asset section
Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery SSRF vulnerability...
CVE-2022-25777 Server-Side Request Forgery in Asset section
Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery SSRF vulnerability...
Server Side Request Forgery (SSRF)
czim/file-handling is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper URL validation in the makeFromUrl and makeFromAny functions, allowing an attacker to make unauthorized requests or read local files...
USN-6885-3 apache2 vulnerabilities
USN-6885-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Orange Tsai discovered that the Apache HTTP Server modrewrite module incorrectly handled certain substitutions. A remote attacker...
1ocalendar (1.0.0), @alpaca-headless/alpaca-headless-nextjs (>=1.0.13, <=1.0.27) +152 more potentially affected by CVE-2024-46982 via next (>=13.5.1, <=13.5.6)
next NPM version =13.5.1, =1.0.13, =1.0.7, =1.0.0, =1.0.5, =0.1.0, =24.4.0, =0.2.7, =5.4.2, =1.0.0, =0.0.1, =0.0.14 and more Source cves: CVE-2024-46982 Source advisory: OSV:GHSA-GP8F-8M3G-QVJ9...