Code injection

This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic...

Cross site scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2015-6964

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. Attackers cannot realistically steal these fees for themselves. This occurs because there is no message authenticati...

Authentication flaw

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. Attackers cannot realistically steal these fees for themselves. This occurs because there is no message authenticati...

CVE-2015-6964

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. Attackers cannot realistically steal these fees for themselves. This occurs because there is no message authenticati...

CVE-2015-6964

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. Attackers cannot realistically steal these fees for themselves. This occurs because there is no message authenticati...

PT-2023-10320 · Unknown · Multibit Hd

Name of the Vulnerable Software and Affected Versions: MultiBit HD versions prior to 0.1.2 Description: The issue allows attackers to conduct bit-flipping attacks, inserting unspendable Bitcoin addresses into the list used to send fees to the developers. This is due to the lack of a message...

gix-transport code execution vulnerability

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution. PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo' This will launch a calculator on OS...

The vulnerability in the `drivers/media/cec/core/cec-api.c` file of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the drivers/media/cec/core/cec-api.c file of the Linux kernel is related to incorrect processing of input data related to the ceclogaddrs structure. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-7MP6-929P-PQHJ Croc requires senders to provide local IP addresses in cleartext

An issue was discovered in Croc before 9.6.16. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

Croc requires senders to provide local IP addresses in cleartext

An issue was discovered in Croc before 9.6.16. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

CVE-2023-43618

CVE-2023-43618 affects Croc (≤9.6.5). The issue is that the protocol requires a sender to provide its local IP addresses in cleartext via an ips? message, exposing internal network identifiers. Several external sources (GHSA-7MP6-929P-PQHJ, OSV entries) corroborate that Croc transmits local IPs i...

CVE-2023-43618

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message...

Beats, Elastic Agent, APM Server, and Fleet Server 8.10.1 Security Update - Improper Certificate Validation issue (ESA-2023-16)

Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue ESA-2023-16 It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however,...

PT-2023-28879 · Croc · Croc

Name of the Vulnerable Software and Affected Versions: Croc versions through 9.6.5 Description: An issue was discovered in the protocol, which requires a sender to provide its local IP addresses in cleartext via an ips? message. Recommendations: For versions through 9.6.5, consider updating to...