CVE-2023-27586

CVE-2023-27586 affects CairoSVG prior to 2.7.0, where Cairo could make requests to external hosts while processing SVGs. The underlying issue is external resource loading, enabling server-side request forgery (SSRF) and potential denial of service. The connected advisories confirm that version 2....

CVE-2023-27586

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

CVE-2023-27586 CairoSVG improperly processes SVG files loaded from external resources

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

Nextcloud: Blind SSRF as normal user from mailapp

Vulnerability description not provided...

glpi -- multiple vulnerabilities

glpi Project reports: Multiple vulnerabilities found and fixed in this version: High CVE-2023-28849: SQL injection and Stored XSS via inventory agent request. High CVE-2023-28632: Account takeover by authenticated user. High CVE-2023-28838: SQL injection through dynamic reports. Moderate...

CairoSVG improperly processes SVG files loaded from external resources

When CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts. When CairoSVG processes an SVG file, it can send requests to external hosts and wait for a response from the external server after a successful TCP handshake. This will cause the server to han...

Server-Side Request Forgery (SSRF)

request is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists due to the Redirect.prototype.redirectTo function in redirect.js, which allows a remote attacker to bypass SSRF protection because library does not properly apply configurations when requests are redirected from...

CVE-2023-28112

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

CVE-2023-28112

Discourse (open‑source discussion platform) has a CVE-2023-28112 issue affecting the beta and tests-passed branches prior to 3.1.0.beta3. The root cause is missing SSRF protection in how some user-provided URLs are passed to FastImage, enabling outbound connections from the Discourse server to pr...

CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

CVE-2023-28111

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

Server side request forgery (ssrf)

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

CVE-2023-28111

CVE-2023-28111 concerns Discourse prior to 3.1.0.beta3 (beta and tests-passed branches), where an attacker can bypass the platform’s SSRF protections for private IPv4 addresses by using an IPv4-mapped IPv6 address. The root cause is a weakness in SSRF filtering that permits IPv4-mapped IPv6 repre...

CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

Discourse 3.1.x < 3.1.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...