GHSA-CJ55-GC7M-WVCQ req may send an unintended request when a malformed URL is provided

The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...

GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog

Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...

Server Side Request Forgery (SSRF)

ckan is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused due to CKAN plugins like XLoader, DataPusher, Resource proxy and ckanext-archiver not validating the resource URLs while making HTTP request to access the remote resources. This can lead to a malicious or unaware...

GHSA-G9PH-J5VJ-F8WM Potential access to sensitive URLs via CKAN extensions (SSRF)

Impact There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local...

Potential access to sensitive URLs via CKAN extensions (SSRF)

Impact There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local...

Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data

Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 CVSS score: 8.5, the vulnerability has been described as an information disclosure bug stemming from a...

GO-2022-0890 Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes

Server Side Request Forgery SSRF in Kubernetes in k8s.io/kubernetes...

GO-2022-0781 Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788) in github.com/goharbor/harbor

Harbor is vulnerable to a limited Server-Side Request Forgery SSRF CVE-2020-13788 in github.com/goharbor/harbor...

GO-2022-0615 Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul...

GO-2022-0566 SSRF in repository migration in gogs.io/gogs

SSRF in repository migration in gogs.io/gogs...

GO-2022-0459 Smokescreen SSRF via deny list bypass (square brackets) in github.com/stripe/smokescreen

Smokescreen SSRF via deny list bypass square brackets in github.com/stripe/smokescreen...

GO-2022-0429 Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen

Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen...

CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF)

CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their...

CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF)

CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their...

CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF)

CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their...

GO-2022-0377 SSRF in repository migration in gogs.io/gogs

SSRF in repository migration in gogs.io/gogs...

GO-2023-1971 Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea...

GO-2023-1982 Gophish vulnerable to Server-Side Request Forgery in github.com/gophish/gophish

Gophish vulnerable to Server-Side Request Forgery in github.com/gophish/gophish...

GO-2023-1761 imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy

imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy...

Trufflehog vulnerable to Blind SSRF in some Detectors

Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...