PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the databaseschema method. The issue results from the lack of proper...

@astro-reactive/common (>=0.2.0, <=0.2.1), @bookshop/astro-engine (>=3.7.0, <=3.10.1) +68 more potentially affected by CVE-2024-47885 via astro (>=3.0.12, <=4.15.12)

astro NPM version =3.0.12, =0.2.0, =3.7.0, =0.40.5, =0.34.0, =0.34.0, =2.8.4, =0.0.2, =2.0.0-alpha.1, =0.0.0-test-20230907022505, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2024-47885 Source advisory: OSV:GHSA-M85W-3H95-HCF9...

Security Bulletin: A vulnerability in HashiCorp Consul affects IBM Robotic Process Automation and may result in server-side request forgery (CVE-2022-29153).

Summary A vulnerability in HashiCorp Consul affects IBM Robotic Process Automation and may result in server-side request forgery. This bulletin identifies the security fix to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-29153 DESCRIPTION: HashiCorp Consul and HashiCorp...

Security Bulletin: Multiple security vulnerabilities in IBM MQ affect IBM Robotic Process Automation.

Summary Multiple security vulnerabilities in IBM MQ affect IBM Robotic Process Automation. This bulletin identifies the security fixes to apply to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere...

PT-2024-8548

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The HttpURI class in Eclipse Jetty does insufficient validation on the authority segment of a URI, which can lead to differences in how it handles invalid URIs compared to common...

Adobe Commerce Server-Side Request Forgery Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from a server-side request forgery vulnerability that can be exploited by an attacker to cause arbitrary file system reads...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-45317

A Server-Side Request Forgery SSRF vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address...

CVE-2024-45317

CVE-2024-45317 is an SSRF vulnerability in SonicWall SMA1000 appliances (firmware 12.4.3-02676 and earlier). The server-side application can be compelled by a remote, unauthenticated attacker to issue requests to unintended IPs. The public sources describe the issue, its impact and that SonicWall...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

CVE-2024-46468

A Server-Side Request Forgery SSRF vulnerability exists in the jpress = v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure...

PYSEC-2024-215

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

GHSA-576C-3J53-R9JJ Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

CVE-2024-47167 SSRF in the path parameter of /queue/join in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

CVE-2024-47167

CVE-2024-47167 affects Gradio (Python) and describes a Server-Side Request Forgery (SSRF) in the /queue/join endpoint via async_save_url_to_cache, allowing an attacker to cause the Gradio server to fetch HTTP requests from user-controlled URLs. This can enable targeting internal services within a...

SonicWall SSL-VPN SMA1000 and Connect Tunnel Windows Client Affected By Multiple Vulnerabilities

1 CVE-2024-45315 - SonicWALL SMA1000 Connect Tunnel Windows Client Link Following Denial-of-Service VulnerabilityThe Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard...

GHSA-G9FM-WC6H-PVGJ Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection ...