BIT-APPSMITH-2022-38298

Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery SSRF via redirecting incoming requests to the AWS internal metadata endpoint...

Amazon Linux 2023 : libuv, libuv-devel, libuv-static (ALAS2023-2024-540)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-540 advisory. libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to...

Debian dla-3752 : libuv1 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3752 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3752-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter...

CVE-2024-27561

WonderCMS (version 3.1.3) is affected by a Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function. The vulnerability allows an attacker to coerce the application into making arbitrary outbound requests by injecting crafted URLs into the installThemePlugin parameter. Pub...

CVE-2024-27564

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading...

CVE-2024-27561

A Server-Side Request Forgery SSRF in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

CVE-2024-27563

CVE-2024-27563 is an SSRF in WonderCMS v3.1.3, traced to the getFileFromRepo function. The flaw lets an attacker coerce the application to make arbitrary outbound requests by injecting crafted URLs into the pluginThemeUrl parameter. Affected software: WonderCMS 3.1.3 (PHP-based CMS). Root cause: ...

CVE-2024-27564

CVE-2024-27564 describes a Server-Side Request Forgery in pictureproxy.php (dirk1983 mm1.ltd, commit f9f4bbc). The flaw allows an attacker to supply a crafted URL via the url parameter to trigger arbitrary requests from the application, potentially reading local or internal resources. Connected d...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

CVE-2024-27565

The CVE-2024-27565 issue affects ChatGPT-wechat-personal, specifically the weixin.php component, where a Server-Side Request Forgery (SSRF) vulnerability exists due to commit a0857f6. The vulnerability allows an attacker to induce the application to make arbitrary outbound requests. According to ...

Amazon Linux 2 : libuv (ALAS-2024-2474)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2474 advisory. libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and...

Image Optimizer, Resizer and CDN – Sirv < 7.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery

Description The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

CVE-2024-26469

Server-Side Request Forgery SSRF vulnerability in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess method...

CVE-2024-26469

Summary of CVE-2024-26469 : A Server-Side Request Forgery (SSRF) vulnerability exists in Tunis Soft’s PrestaShop productmodule “Product Designer” (productdesigner) before version 1.178.36. The root cause is an unsafe handling of the url parameter in the postProcess() method, enabling remote attac...

CVE-2024-26469

Server-Side Request Forgery SSRF vulnerability in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess method...