Threats tagged 'ghsa-w347-5697-hmm3'

MikroDash versions before 0.8.79 have a server-side request forgery (SSRF) vulnerability that allows any signed-in user, including those with viewer roles, to send requests to internal network addresses via notification channels. This can be exploited by setting webhook or mail destinations to internal or loopback addresses and triggering a test notification call.