https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:11:22 +0000 https://vulnerability.circl.lu/vuln/cve-2017-18638 <p>send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.</p> <p>send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.</p> https://vulnerability.circl.lu/vuln/cve-2017-18638 https://vulnerability.circl.lu/vuln/usn-6243-1 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: graphite-web, Ubuntu:Pro:16.04:LTS: graphite-web, Ubuntu:Pro:18.04:LTS: graphite-web, Ubuntu:20.04:LTS: graphite-web, Ubuntu:22.04:LTS: graphite-web</p> <p>It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)</p> <p>It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2022-4728, CVE-2022-4729, CVE-2022-4730)</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: graphite-web, Ubuntu:Pro:16.04:LTS: graphite-web, Ubuntu:Pro:18.04:LTS: graphite-web, Ubuntu:20.04:LTS: graphite-web, Ubuntu:22.04:LTS: graphite-web</p> <p>It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)</p> <p>It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2022-4728, CVE-2022-4729, CVE-2022-4730)</p> https://vulnerability.circl.lu/vuln/usn-6243-1