Lambdasawa

**Name of the Vulnerable Software and Affected Versions** httparty versions prior to 0.23.2 **Description** httparty is susceptible to a Server-Side Request Forgery (SSRF) condition in versions 0.23.2 and earlier. This issue could lead to the disclosure of API keys and enable unauthorized requests to internal servers. **Recommendations** Update to a version of httparty later than 0.23.2.

**Name of the Vulnerable Software and Affected Versions** URI gem versions prior to 0.11.3 URI gem versions 0.12.0 through 0.12.3 URI gem versions 0.13.0 through 0.13.1 URI gem versions 1.0.0 through 1.0.2 **Description** The URI handling methods (`URI.join`, `URI#merge`, `URI#+`) in the URI gem for Ruby have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. This could lead to an unintended userinfo leak when generating a URL to a malicious host from a URL containing secret userinfo using these methods. **Recommendations** For URI gem versions prior to 0.11.3, update to version 0.11.3 or later. For URI gem versions 0.12.0 through 0.12.3, update to version 0.12.4 or later. For URI gem versions 0.13.0 through 0.13.1, update to version 0.13.2 or later. For URI gem versions 1.0.0 through 1.0.2, update to version 1.0.3 or later. As a temporary workaround, consider avoiding the use of `URI#join`, `URI#merge`, and `URI#+` methods until a patch is available.

Name of the Vulnerable Software and Affected Versions: axios versions 1.0.0 through 1.8.1 Bamboo Data Center and Server versions 9.6.1 through 11.0.0 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in axios when handling absolute URLs instead of protocol-relative URLs. Even with a `baseURL` configured, axios may send requests to the specified absolute URL, potentially leading to SSRF and credential leakage. This impacts both server-side and client-side usage. The vulnerability allows attackers to access internal network resources and potentially access sensitive credentials. Millions of systems may be affected. Recommendations: Upgrade axios to version 1.8.2 or later. Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.20. Bamboo Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.12. Bamboo Data Center and Server 11.0: Upgrade to a release greater than or equal to 11.0.8.