Headline

GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request

The Request package through 2.88.2 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

1 year ago

ghsa

Open in Source

#vulnerability #nodejs #js #git #ssrf

Server-Side Request Forgery in Request

Moderate severity GitHub Reviewed Published Mar 16, 2023 to the GitHub Advisory Database • Updated Mar 16, 2023

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704.

1 year ago

CVE

Open in Source

#vulnerability #dos #apache #nodejs #js #java #ssrf #vmware #auth #ibm #ssl

CVE-2023-28155

** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

1 year ago

CVE

Open in Source

#vulnerability #nodejs #js #ssrf #pdf