CVE-2022-0767
published 2022-03-07CVE-2022-0767: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
PriorityP346critical9.9CVSS 3.1
AVNACLPRNUINSCCLILAH
EPSS
0.96%
57.1th percentile
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| calibreweb | calibreweb | >= 0 < 0.6.17 | 0.6.17 |
| janeczku | calibre-web | < 0.6.17 | 0.6.17 |
| janeczku | janeczku_calibre-web | >= unspecified < 0.6.17 | 0.6.17 |
| mozilla | nss | >= 0 < 2:3.35-2ubuntu2.16 | 2:3.35-2ubuntu2.16 |
| mozilla | nss | >= 0 < 2:3.49.1-1ubuntu1.9 | 2:3.49.1-1ubuntu1.9 |
| mozilla | nss | >= 0 < 2:3.68.2-0ubuntu1.2 | 2:3.68.2-0ubuntu1.2 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
cisa6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nss vulnerabilities
osv·2023-02-27·CVSS 7.5
CVE-2022-3479 nss vulnerabilities
nss vulnerabilities
It was discovered that NSS incorrectly handled client authentication
without a user certificate in the database. A remote attacker could
possibly use this issue to cause a NSS client to crash, resulting in a
denial of service. This issue only affected Ubuntu 22.10. (CVE-2022-3479)
Christian Holler discovered that NSS incorrectly handled certain PKCS 12
certificated bundles. A remote attacker could use this issue to cause NSS
to crash, leading to a denial of service, or possibly execute arbitrary
code. (CVE-2023-0767)
GHSA
Server-Side Request Forgery in calibreweb
ghsa·2022-03-08
CVE-2022-0767 [CRITICAL] CWE-918 Server-Side Request Forgery in calibreweb
Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.
OSV
Server-Side Request Forgery in calibreweb
osv·2022-03-08
CVE-2022-0767 [CRITICAL] Server-Side Request Forgery in calibreweb
Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.
CISA
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
cisa·2022-06-08·CVSS 6.1
CVE-2012-0767 [MEDIUM] CWE-79 Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Vulnerability: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Affected: Adobe Flash Player
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-0767
Remediation Due Date: 2022-06-22
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8https://huntr.dev/bounties/b26fc127-9b6a-4be7-a455-58aefbb62d9ehttps://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8https://huntr.dev/bounties/b26fc127-9b6a-4be7-a455-58aefbb62d9e
2022-03-07
Published