13382 matches found
NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint
NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using...
CVE-2024-42352
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352
CVE-2024-42352 concerns the Nuxt icon API exposed at /api/_nuxt_icon/[name]. The issue stems from how the proxied request path is parsed, allowing an attacker to change the scheme and host of the request via the new URL constructor, which tolerates poorly formatted URLs. This can enable SSRF, pot...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
GHSA-CXGV-PX37-4MP2 Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...
@bloggrify/bento (>=0.9.1, <=0.9.4), @bloggrify/core (>=1.1.1, <=1.4.5) +62 more potentially affected by CVE-2024-34343 via nuxt (>=3.0.0, <=3.12.3)
nuxt NPM version =3.0.0, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =4.0.3, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.5.0, =1.0.0-beta.11, =1.2.0 and more Source cves: CVE-2024-34343 Source advisory: OSV:GHSA-VF6R-87Q4-2VJF...
CVE-2024-36448
Apache IoTDB Workbench is affected by a Server-Side Request Forgery (SSRF) vulnerability. Affects versions 0.13.0 and later; attackers can access the local network. The project is retired and no fix will be released; users should restrict access to trusted users or seek alternatives as a temporar...
CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...
CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...
Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
GHSA-FFXG-5F8M-H72J Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
CVE-2024-39713
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
CVE-2024-39713
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
CVE-2024-39713
A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...
Exploit for Server-Side Request Forgery in Apache Http_Server
It is an offensive tool for web applications. The repository app...
Security Bulletin: IBM Content Navigator is vulnerable to Cross Site Port Attack due to Daeja ViewONE (CVE-2024-31897)
Summary Daeja ViewOne Virtual is used by IBM Content Navigator as part of the document viewer. CVE-2024-31897 Vulnerability Details CVEID:CVE-2024-31897 DESCRIPTION: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0....
CVE-2024-39637
Server-Side Request Forgery SSRF vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through = 9.2.0...
CVE-2024-39637 WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through = 9.2.0...