CVE-2024-13666

CVE-2024-13666 concerns the Fluent Forms WordPress plugin (versions up to and including 5.2.12) with an IP address spoofing vulnerability caused by insufficient IP validation and reliance on user-supplied HTTP headers for IP retrieval. This enables unauthenticated attackers to spoof their IP and ...

CVE-2024-13666 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for...

CVE-2025-22271

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271

CVE-2025-22271 affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The issue allows an attacker to spoof the client’s IP by supplying a value in the X-Forwarded-For header, which degrades accountability of action logging in the application. Other versions are listed as unknown. Pu...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2024-56473

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers...

CVE-2024-56473

CVE-2024-56473 affects IBM Aspera Shares 1.9.0 through 1.10.0 PL6. The root cause is improper verification of the Client-IP header, allowing an attacker to spoof their IP address and have it written to log files. According to the IBM Security Bulletin, remediation is to upgrade to IBM Aspera Shar...

CVE-2024-56473 IBM Aspera Shares Data Manipulation

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers...

CVE-2024-56473 IBM Aspera Shares Data Manipulation

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers...

CVE-2024-43099

The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...

CVE-2024-28144 Broken Access Control

An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user...

PT-2024-19800 · Levelone · Levelone Wbr-6012

Name of the Vulnerable Software and Affected Versions: LevelOne WBR-6012 version R0.40e6 Description: The issue is related to an authentication bypass in the web application of the router, which relies on client IP addresses for authentication. This allows attackers to spoof an IP address and gai...

CVE-2022-4534

The Limit Login Attempts Spam Protection plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can suppl...

CVE-2022-4534 Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass

The Limit Login Attempts Spam Protection plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can suppl...

CVE-2022-4534

CVE-2022-4534 affects WordPress plugin Limit Login Attempts (Spam Protection) up to version 5.3. It stems from insufficient restrictions on where IP address information is retrieved for request logging and login restrictions, allowing an attacker to spoof IPs via the X-Forwarded-For header to byp...

CVE-2022-4534 Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass

The Limit Login Attempts Spam Protection plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can suppl...

WordPress Limit Login Attempts Plus plugin <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass vulnerability

IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin Limit Login Attempts Plus versions = 1.1.0...

CVE-2022-4533

The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...