13550 matches found
EulerOS 2.0 SP10 : libuv (EulerOS-SA-2024-1572)
According to the versions of the libuv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows...
EulerOS 2.0 SP10 : libuv (EulerOS-SA-2024-1594)
According to the versions of the libuv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows...
WordPress Starter Templates Plugin <= 4.1.6 is vulnerable to Server Side Request Forgery (SSRF)
Software Starter Templates Type Plugin Vulnerable versions = 4.1.6 Fixed in 4.1.7 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-1467 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID f703c4115837 Credits Lucio Sá Required privilege...
FreeBSD : Gitlab -- vulnerabilities (fbc2c629-0dc5-11ef-9850-001b217b3468)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fbc2c629-0dc5-11ef-9850-001b217b3468 advisory. - Gitlab reports: ReDoS in branch search when using wildcards ReDoS in markdown render pipelin...
Gitlab -- vulnerabilities
Gitlab reports: ReDoS in branch search when using wildcards ReDoS in markdown render pipeline Redos on Discord integrations Redos on Google Chat Integration Denial of Service Attack via Pin Menu DoS by filtering tags and branches via the API MR approval via CSRF in SAML SSO Banned user from group...
CVE-2024-33857
An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...
curl: Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
Vulnerability description not provided...
CVE-2023-7240 Broken Access Control leading to SSRF in NetIQ Identity Console
An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open services enumeration. Server makes query to provided server Server IP/DNS field and is triggering connection to arbitrary address...
CVE-2023-7240 Broken Access Control leading to SSRF in NetIQ Identity Console
An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open services enumeration. Server makes query to provided server Server IP/DNS field and is triggering connection to arbitrary address...
CVE-2024-33857
An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...
SUSE: Security Advisory (SUSE-SU-2024:0851-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-33857
An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...
CVE-2024-33117
crmebjava v1.3.4 was discovered to contain a Server-Side Request Forgery SSRF via the mergeList method in class com.zbkj.front.pub.ImageMergeController...
PT-2024-4071
Name of the Vulnerable Software and Affected Versions: ip package versions through 2.0.1 for Node.js Description: The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic function, which might allow Server-Side Request Forgery SSRF attacks...
CVE-2024-33117
CVE-2024-33117 affects crmeb_java v1.3.4, with a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController . Documents indicate the issue exists in this component and provides a practical remediation: temporarily disable the mergeList method and ...
CVE-2024-33117
crmebjava v1.3.4 was discovered to contain a Server-Side Request Forgery SSRF via the mergeList method in class com.zbkj.front.pub.ImageMergeController...
CVE-2024-33117
crmebjava v1.3.4 was discovered to contain a Server-Side Request Forgery SSRF via the mergeList method in class com.zbkj.front.pub.ImageMergeController...
GHSA-QQ22-JJ8X-4WWV Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull
Impact An authenticated user who has access to a game server is able to bypass the previously implemented access control https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This wou...
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull
Impact An authenticated user who has access to a game server is able to bypass the previously implemented access control https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This wou...