CVE-2024-54000 Mobile Security Framework (MobSF) bypass of SSRF fix

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get request in the checkurl method is specified as allowredirects=True, which allows a server-side reque...

PT-2024-36007 · Unknown · Mobile Security Framework

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 3.9.7 Description: The issue concerns a server-side request forgery vulnerability. It occurs when the requests.get request in the check url method is set to allow redirects=True, allowing a...

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

Server Side Request Forgery (SSRF)

github.com/openshift/console is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to the lack of proper checks on the /api/dev-console/proxy/internet endpoint, which allows authenticated users to make arbitrary HTTP requests from the console's pod to services inside the...

PT-2024-9306 · Sap · Sap Netweaver Administrator

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Administrator affected versions not specified Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting in...

CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.8...

CVE-2024-53738

CVE-2024-53738 describes a Server-Side Request Forgery (SSRF) in the WordPress plugin Asset CleanUp: Page Speed Booster, affected versions are up to 1.3.9.8. The CVE entry notes a MEDIUM severity with CVSSv3.1 base score 4.4 and that the vulnerability affects authenticated users (admin+). Connect...

PT-2024-35846 · WordPress · Asset Cleanup: Page Speed Booster

Name of the Vulnerable Software and Affected Versions: Asset CleanUp: Page Speed Booster versions 1.3.9.8 and earlier Description: A Server-Side Request Forgery SSRF issue affects the Asset CleanUp: Page Speed Booster plugin, allowing an attacker to perform Server Side Request Forgery. This could...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

PT-2024-26507 · Linkstack · Linkstack

Name of the Vulnerable Software and Affected Versions: LinkStack versions 2.7.9 through 4.7.7 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. It affects the resourcesviewscomponentsfavicon.blade.php file, allowing it to be linked with SSRF. This vulnerability poses a...

CVE-2024-35451

LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF...

PT-2024-25012 · Openai · Openai Api

Name of the Vulnerable Software and Affected Versions: lobe-chat versions prior to 1.19.13 Description: Lobe Chat is an open-source, AI chat framework. The issue allows an attacker to construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive...

@alexaegis/svelte-config (>=0.9.2, <=0.11.6), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=1.1.3) +7 more potentially affected by CVE-2024-53262 via @sveltejs/kit (>=2.0.0, <=2.8.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.0-52469075, =10.0.1, =0.0.1-alpha.26, =0.0.10, =1.0.2, =1.0.3 Source cves: CVE-2024-53262 Source advisory: OSV:GHSA-MH2X-FCQH-FMQV...

OpenShift Console Server Side Request Forgery vulnerability

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

GHSA-V3W7-G6P2-MPX7 OpenShift Console Server Side Request Forgery vulnerability

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CVE-2024-6538

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CVE-2024-6538

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CVE-2024-6538

CVE-2024-6538 is an OpenShift Console Server‑Side Request Forgery vulnerability. An authenticated user can abuse the /api/dev-console/proxy/internet endpoint to command the console pod to perform arbitrary HTTP(S) requests, potentially reaching services inside the cluster that are not exposed to ...

CVE-2024-6538 Openshift-console: openshift console: server-side request forgery

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...