Threats Tagged 'cwe-918'

CVE-2026-77987 is a critical server-side request forgery (SSRF) vulnerability in the notebook viewer component of GitHub Enterprise Server. The vulnerability arises because the notebook viewer validates the scheme and host of user-supplied URLs but fails to validate the port, allowing requests to internal services on different ports. Although response bodies are not returned, response timing can be used to extract instance secrets character by character. These secrets can then be leveraged to achieve remote code execution on the appliance. The vulnerability affects GitHub Enterprise Server versions 3.17 through 3.22 and requires network access to the instance. Exploitation is unauthenticated if private mode is disabled, or requires any authenticated user if private mode is enabled. Fixed versions include 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.

CVE-2026-91129 is a Server-Side Request Forgery (SSRF) vulnerability in the Home Assistant core's IPP integration prior to version 2026.2.3. The vulnerability arises because the IPP integration automatically processes unauthenticated mDNS announcements and passes attacker-controlled parameters to a validation function that uses an HTTP client. This client follows redirects without blocking requests to loopback addresses, allowing a local network attacker to redirect requests to internal services such as 127.0.0.1 without user interaction or prior configuration. The issue is fixed in Home Assistant version 2026.2.3.

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Experience Manager (AEM) 6.5 Forms JEE contains a Server-Side Request Forgery (SSRF) vulnerability that allows a low-privileged attacker to escalate privileges and gain elevated access to internal resources without requiring user interaction. The vulnerability affects versions up to and including 6.5.25. The issue changes the security scope and has a critical severity rating with a CVSS score of 9.6.

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, JiraUserMixin._lookup_user_by_permissions uses the module-level requests.get function instead of the fetcher's protected session. A caller-controlled public Jira URL can redirect that unhooked request to an internal address, bypassing the redirect checks added for CVE-2026-27826. The advisory traces the vulnerable input and processing flow through JiraUserMixin._lookup_user_by_permissions, requests.get, self.jira._session.get, and _make_ssrf_safe_hook, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVE-2026-77261 is a Server-Side Request Forgery (SSRF) vulnerability in the MCP Atlassian server component for Atlassian products like Confluence and Jira. Versions prior to 0.22.0 omit a safety hook in certain session branches, allowing attacker-controlled redirects to internal addresses without proper validation. This can lead to unauthorized internal network access. The issue is fixed in version 0.22.0.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is public during validation and private during connection, preserving unauthenticated access to internal or metadata endpoints despite the earlier CVE-2026-27826 remediation. The advisory traces the vulnerable input and processing flow through validate_url_for_ssrf, _check_dns_resolution, socket.getaddrinfo, and _make_ssrf_safe_hook, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVE-2026-77267 is a Server-Side Request Forgery (SSRF) vulnerability in the MCP Atlassian server component used for Atlassian products like Confluence and Jira. Versions prior to 0.22.0 improperly process certain HTTP headers (X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url) without validating URLs for SSRF, allowing an attacker who can set these headers to cause the server to send requests to internal or metadata-service URLs. This vulnerability bypasses previous remediation efforts and is fixed in version 0.22.0.

CVE-2026-77265 is a Server-Side Request Forgery (SSRF) vulnerability in the MCP Atlassian server component used for Atlassian products like Confluence and Jira. Versions prior to 0.22.0 improperly validate header-supplied Jira or Confluence URLs, allowing an unauthenticated attacker to exploit DNS rebinding to make requests to internal or metadata services. This vulnerability is fixed in version 0.22.0.