Vocechat Server
Monthly
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).