CVE-2018-17412

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

CVE-2018-17412

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

CVE-2018-17412

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

CVE-2018-17412

CVE-2018-17412 affects the ZZCMS package, specifically v8.3, with a SQL injection in /user/logincheck.php exploitable via the X-Forwarded-For HTTP header. The issue stems from unsafely incorporating header data into SQL queries, enabling an attacker to execute arbitrary SQL. CVSS data indicates h...

PT-2019-9465

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a SQL Injection vulnerability. It is located in the /user/logincheck.php file and can be exploited via the X-Forwarded-For HTTP header. Recommendations For zzcms version 8.3, consider...

CVE-2018-17412: Improper Neutralization of Special Elements used in an SQL Command

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

Sql injection

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 is vulnerable to SQL injection in get_ip() (system/class/helper_class.php) via the X-Forwarded-For HTTP header, exploitable at user/index.php?load=login&act=act_login. Affected component: get_ip() function; root cause: insufficient validation/filtering of HTTP header data leading to ...

PT-2018-14970

Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description The issue concerns a SQL injection in the get ip function located in system/class/helper class.php. This occurs via the X-Forwarded-For HTTP header when accessing the "user/index.php?load=login&act=act login"...

CVE-2018-19468: Improper Neutralization of Special Elements used in an SQL Command

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

HackerOne: Denial of service via cache poisoning

An attacker can persistently block access to any/all redirects on www.hackerone.com by using cache poisoning with the X-Forwarded-Port or X-Forwarded-Host headers to redirect users to an invalid port. To replicate: curl -H 'X-Forwarded-Port: 123'...

CVE-2018-16832

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

CVE-2018-16832: Cross-Site Request Forgery (CSRF)

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

PT-2018-13765

Name of the Vulnerable Software and Affected Versions xunfeng version 0.2.0 Description The issue allows an attacker to modify the configuration via a Flash file. This is possible because the views/lib/AntiCSRF.py file can overwrite the request.host value with the content of the X-Forwarded-Host...

Red Hat CloudForms Management Engine CRLF Injection Vulnerability

Red Hat CloudForms Management Engine is a management engine for IaaS cloud service solutions. A CRLF injection vulnerability in Ansible Tower for Red Hat CloudForms Management Engine allows remote attackers to submit a special X-Forwarded-For packet header request to obtain sensitive information...

CVE-2017-7528

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...

Crlf injection

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...