https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 21:04:15 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-127145 <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> https://db.gcve.eu/vuln/fkie_cve-2026-127145 https://db.gcve.eu/vuln/ghsa-m3cx-88pq-ww6w <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> https://db.gcve.eu/vuln/ghsa-m3cx-88pq-ww6w https://db.gcve.eu/vuln/ubuntu-cve-2026-127145 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: sogo, Ubuntu:Pro:18.04:LTS: sogo, Ubuntu:Pro:20.04:LTS: sogo, Ubuntu:Pro:22.04:LTS: sogo, Ubuntu:26.10: sogo, Ubuntu:Pro:26.04:LTS: sogo</p> <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: sogo, Ubuntu:Pro:18.04:LTS: sogo, Ubuntu:Pro:20.04:LTS: sogo, Ubuntu:Pro:22.04:LTS: sogo, Ubuntu:26.10: sogo, Ubuntu:Pro:26.04:LTS: sogo</p> <p>SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server&#39;s position.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-127145