Server-side Request Forgery (SSRF)

Overview @aborruso/ckan-mcp-server is a MCP server for interacting with CKAN open data portals Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the validateServerUrl hostname check in src/utils/http.ts. An attacker can make the server send outbound...

CVE-2024-40720

The CVE-2024-40720 entry concerns CHANGING Information Technology’s TCBServiSign Windows Version. A specific API fails to properly validate server-side input, enabling unauthenticated, remote attackers to modify the HKEY_CURRENT_USER registry when a user visits a spoofed website and execute arbit...

CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...

CVE-2015-3324

The ThinkServer System Manager TSM Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers...