Lucene search
+L

4613 matches found

IBM Security Bulletins
IBM Security Bulletins
added 2025/11/18 7:10 p.m.6 views

Security Bulletin: Astronomer with IBM is vulnerable to memory leaks due to the undici package (CVE-2025-47279)

Summary Undici is used by Astronomer with IBM as part of the HTTP processing functionality. Vulnerability Details CVEID:CVE-2025-47279 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like syste...

3.1CVSS6AI score0.00302EPSS
SaveExploits0Affected Software1
RedhatCVE
RedhatCVE
added 2025/11/17 9:07 a.m.22 views

CVE-2025-13174

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function dojob of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument webhookurl can lead to server-side request...

6.5CVSS6.7AI score0.0026EPSS
SaveExploits0References1
EUVD
EUVD
added 2025/11/14 9:30 p.m.10 views

EUVD-2025-197656

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function dojob of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument webhookurl can lead to server-side request...

6.5CVSS6.3AI score0.0026EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2025/11/14 7:59 p.m.11 views

CVE-2025-64709

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.6CVSS6.8AI score0.00376EPSS
SaveExploits1References1
NVD
NVD
added 2025/11/14 7:15 p.m.26 views

CVE-2025-13174

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function dojob of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument webhookurl can lead to server-side request...

6.5CVSS0.0026EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2025/11/14 6:32 p.m.10 views

CVE-2025-13174 rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function dojob of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument webhookurl can lead to server-side request...

6.5CVSS6.5AI score0.0026EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2025/11/14 6:32 p.m.26 views

CVE-2025-13174 rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function dojob of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument webhookurl can lead to server-side request...

6.5CVSS0.0026EPSS
SaveExploits0References4
CVE
CVE
added 2025/11/14 6:32 p.m.50 views

CVE-2025-13174

CVE-2025-13174 affects rachelos WeRSS we-mp-rss up to 1.4.7. The vulnerability lies in the Webhook Module’s function do_job (file path: /rachelos/we-mp-rss/blob/main/jobs/mps.py). Manipulating the argument web_hook_url can lead to server-side request forgery (SSRF). The attack may be executed rem...

6.5CVSS6.5AI score0.0026EPSS
SaveExploits0References4
CNNVD
CNNVD
added 2025/11/14 12:00 a.m.7 views

WeRSS 代码问题漏洞

WeRSS is a WeChat public number system by Rachel open source. A code issue vulnerability exists in WeRSS 1.4.7 and earlier versions, which stems from incorrect manipulation of the parameter webhookurl in the component Webhook Module, which could lead to server-side request forgery...

6.5CVSS6.5AI score0.0026EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2025/11/14 12:00 a.m.19 views

PT-2025-46996

Name of the Vulnerable Software and Affected Versions rachelos WeRSS we-mp-rss versions up to 1.4.7 Description A flaw exists in the Webhook Module of rachelos WeRSS we-mp-rss. The do job function within the /rachelos/we-mp-rss/blob/main/jobs/mps.py file is susceptible to server-side request...

6.5CVSS6.3AI score0.0026EPSS
SaveExploits0References8
NVD
NVD
added 2025/11/13 8:15 p.m.10 views

CVE-2025-64709

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.9CVSS0.00376EPSS
SaveExploits1References1
EUVD
EUVD
added 2025/11/13 7:42 p.m.12 views

EUVD-2025-175361

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.6CVSS6.3AI score0.00376EPSS
SaveExploits1References1
OSV
OSV
added 2025/11/13 7:42 p.m.10 views

CVE-2025-64709 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.6CVSS6.8AI score
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2025/11/13 7:42 p.m.8 views

CVE-2025-64709 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.6CVSS6.4AI score0.00376EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2025/11/13 7:42 p.m.17 views

CVE-2025-64709 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

9.6CVSS0.00376EPSS
SaveExploits1References1
CVE
CVE
added 2025/11/13 7:42 p.m.31 views

CVE-2025-64709

Typebot (open-source chatbot builder) contains an SSRF flaw in the webhook block’s HTTP Request component affecting versions before 3.13.1. The issue lets authenticated users cause server-side HTTP requests, bypass IMDSv2 via custom header injection, and extract temporary AWS IAM credentials for ...

9.9CVSS6.4AI score0.00376EPSS
SaveExploits1References1Affected Software1
CNNVD
CNNVD
added 2025/11/13 12:00 a.m.10 views

Typebot 代码问题漏洞

Typebot is an open source chatbot builder by the individual developer Baptiste Arnaud. A code issue vulnerability exists in versions prior to Typebot 3.13.1 that stems from a server-side request forgery in the Typebot webhook block functionality, which could lead to the extraction of AWS IAM...

9.9CVSS6.8AI score0.00376EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2025/11/13 12:00 a.m.12 views

PT-2025-46903

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.13.1 Description Typebot is an open-source chatbot builder. A Server-Side Request Forgery SSRF issue exists in the Typebot webhook block HTTP Request component functionality. This allows authenticated users to make...

9.9CVSS6.5AI score0.00376EPSS
SaveExploits1References8
RedhatCVE
RedhatCVE
added 2025/11/12 8:48 a.m.18 views

CVE-2025-64522

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

9.1CVSS6.7AI score0.00343EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2025/11/11 9:30 p.m.12 views

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

8.7CVSS6.6AI score0.003EPSS
SaveExploits0References1
Rows per page
Query Builder