Authorization Bypass

@waline/vercel is vulnerable to authorization bypass. A remote attacker is able to use this vulnerability to fake the IP address and bypass the IP frequency limit of the system, so that the administrator cannot accurately obtain the IP address of the sender...

CVE-2021-25042

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

CVE-2021-25042

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

CVE-2021-25042 WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

CVE-2021-45977

JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC used as...

CVE-2021-45977

JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC used as...

CVE-2021-45977

CVE-2021-45977 affects JetBrains IDEs used as Remote Development backends where the affected products bound to the 0.0.0.0 address. The vulnerability description from connected sources notes exposure of the backend service due to binding to an all interfaces address. Fixed versions are provided: ...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

CVE-2022-24594 affects waline 1.6.1. An attacker can submit messages with a forged IP address by manipulating the X-Forwarded-For header, enabling IP spoofing. Multiple connected sources (Red Hat advisory, Veracode note) indicate this can bypass IP-related checks such as IP frequency limits, affe...

CVE-2022-25305

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the /includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site...

Scylla - The Simplistic Information Gathering Engine | Find Advanced Information On A Username, Website, Phone Number, Etc

Notice For Deprecation This project is no longer being worked on by the developer. As of today, the program has many flaws and is not up to modern OSINT standards. A lot of APIs utilized within Scylla are no longer working as they did when the project was first released. The developer wrote Scyll...

CVE-2017-0371

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attrtitle url;" attack within a DIV element that has an attacker-controlled URL in the title attribute...

CVE-2017-0371

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attrtitle url;" attack within a DIV element that has an attacker-controlled URL in the title attribute...

CVE-2017-0371

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attrtitle url;" attack within a DIV element that has an attacker-controlled URL in the title attribute...

CVE-2017-0371

MediaWiki vulnerability CVE-2017-0371 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV containing an attacker-controlled URL in the title attribute. Affected are MediaWiki versions: pre-1.23.16; 1.24.x throu...

The vulnerability of D-Link DIR-882 wireless routers’ microprogramming software lies in the improper handling of the LocalIPAddress parameter, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DIR-882 wireless routers’ microprogramming software is related to incorrect processing of the LocalIPAddress parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafted HNAP1 POST requests...

GHSA-F9FQ-VJVH-779P Improper Input Validation in vault-ssh-helper

HashiCorp vault-ssh-helper github.com/hashicorp/vault-ssh-helper/helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0...

Design/Logic Flaw

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

AlmaLinux 8 : rust-toolset:rhel8 (ALSA-2021:4270)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4270 advisory. rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string CVE-2021-29922 Tenable has extracted the preceding description block...

CVE-2021-45998

D-Link device DIR882 DIR882FW1.30B06Hotfix02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request...