CVE-2015-3224

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

CVE-2015-3224

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

CVE-2015-3224

CVE-2015-3224 affects Ruby on Rails Web Console (Web Console) prior to 2.1.3 when used with Rails 3.x/4.x. The root cause is improper restriction of X-Forwarded-For headers, allowing remote bypass of the whitelisted_ips protection via a crafted request. Exploitation is demonstrated in public advi...

CVE-2015-3224: Improper Access Control

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

SS-2015-013: X-Forwarded-Host request hostname injection

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...

Magento Community Edition and Enterprise Edition Authentication Bypass Vulnerability

Magento is a professional open-source PHP e-commerce system from Magento, which provides rights management, search engine and payment gateway, etc. Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. A security vulnerability exists in Magent...

CVE-2015-3457: Improper Authentication

Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter...

PT-2015-6238

Name of the Vulnerable Software and Affected Versions Magento Community Edition CE version 1.9.1.0 Magento Enterprise Edition EE version 1.14.1.0 Description The issue allows remote attackers to bypass authentication. This is achieved via the forwarded parameter. Recommendations For Magento...

DamiCMS any control of voting number of votes-vulnerability warning-the black bar safety net

DamiCMS any control of voting number of votes Vote the key code is as follows. foreach$POST'vote' as $v vardump$v; $v = strreplace"\n","",$v; $s = explode"=",$v; vardump$s; $data'vote' = strreplace$v,$s0."=". intval$s1 + 1,$data'vote'; vardump$data; if$vote-where'id='. intval$POST'id'-save$data...

DamiCMS 任意控制投票票数

简要描述： DamiCMS 任意控制投票票数 详细说明： 投票的关键代码如下。 foreach$POST'vote' as $v vardump$v; $v = strreplace"\n","",$v; $s = explode"=",$v; vardump$s; $data'vote' = strreplace$v,$s0."=".intval$s1 + 1,$data'vote'; vardump$data; if$vote-where'id='.intval$POST'id'-save$data 传入的数据用等号分割，类似 选项1=3 会变成 array选项1,3，...

WDCP后台的登录IP可被伪造

简要描述： 据说可以让名字或ID,永久驻留wdcp的手册里 详细说明： 本漏洞台词方法灵感等部分or均来自 ksc 前辈某个漏洞的描述 （=感觉我厚脸皮呀=） 我不知道要不要这样说明一下噢，如果不需要的话，管理大大删掉这三段呗 获取用户ip的时候 使用了信息 X-Forwarded-For 假如仅仅是提示用户的地方使用的此信息，则问题不是很严重 若其他地方有基于ip地址做安全校验的地方就修改下代码吧 首先，在一些改X-Forwarded-For的插件里面，改自己想要的IP，比如9.9.9.9 然后登录 漏洞证明：...

wdcp X-Forwarded-For injected vulnerability analysis-vulnerability warning-the black bar safety net

Originally this article want and on the article written together, but because of Bad typography will further write this post. 1 3 years of vulnerability, the Internet also does not have this vulnerability details this vulnerability to use the tool, so hold learning mentality, try to analyze it. 0...

DEBIAN-CVE-2014-9494

RabbitMQ before 3.4.0 allows remote attackers to bypass the loopbackusers restriction via a crafted X-Forwareded-For header...

UBUNTU-CVE-2014-9494

RabbitMQ before 3.4.0 allows remote attackers to bypass the loopbackusers restriction via a crafted X-Forwareded-For header...

CVE-2014-9494

RabbitMQ Server prior to version 3.4.0 is vulnerable to a security bypass where an attacker can bypass the loopback_users restriction by sending a crafted X-Forwarded-For header. Affected product: RabbitMQ server (up through 3.3.x). Root cause: improper handling of the X-Forwarded-For header allo...

PT-2015-4244

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.4.0 Description The issue allows remote attackers to bypass the loopback users restriction. This is achieved by sending a crafted X-Forwarded-For header. Recommendations For versions prior to 3.4.0, update to versi...

CVE-2014-6230

WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header...

Design/Logic Flaw

WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header...

CVE-2014-6230

WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header...

PT-2014-7103 · WordPress · Wp-Ban

Name of the Vulnerable Software and Affected Versions: WP-Ban plugin versions prior to 1.6.4 Description: The issue allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header when running in certain configurations. Recommendations: For WP-Ban plugin versions prior to...