Threats tagged 'ghsa-xw2v-2m2w-4pmq'

Omnom versions through 0.9.0 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to the /add_feed endpoint. This flaw enables attackers to supply internal addresses that the application fetches without validation, potentially allowing probing of internal hosts and ports via reflected error messages.