Design/Logic Flaw

Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP v4 Too Big packet generation. After a bpfxdpadjusthead call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content ...

CVE-2023-49062

Summary: CVE-2023-49062 affects Meta Katran. After a bpf_xdp_adjust_head call, Katran could write uninitialized kernel memory into the IPv4 Identification field during IPv4 encapsulation (and ICMPv4 Too Big packet generation), exposing kernel memory content. This occurs in all Katran versions pri...

CVE-2023-49062

Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP v4 Too Big packet generation. After a bpfxdpadjusthead call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content ...

CVE-2023-5653

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins...

Medium: mod_wsgi

Issue Overview: A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing. CVE-2022-2255 Affected Packages:...

CVE-2023-37281 Out-of-bounds read during IPHC address decompression

Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no similar check is done...

Rate Limit Bypass

Azuracast is vulnerable to Rate Limit Bypass. The vulnerability arises because the existing rate limiting functionality trusts the arbitrary user input coming from the X-Forwarded-For and Client IP header. The vulnerability could allow an attacker to brute force a user password...

FreeBSD : FreeBSD -- Stack overflow in ping(8) (a005aea9-47bb-11ee-8e38-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a005aea9-47bb-11ee-8e38-002590c1f29c advisory. - ping reads raw IP packets from the network to process responses in the prpack function. As part of...

PT-2023-25576

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.4.3 and 2023.5.5 Description The issue concerns the lack of verification of the source of the X-Forwarded-For and X-Real-IP headers in authentik, an open-source Identity Provider. This poses a security risk whe...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik Open Source. A security vulnerability exists in authentik version 2023.4.3, 2023.5.5, which stems from a vulnerability that does not validate the origin of X-Forwarded-For and X-Real-IP headers in Python code and go...

RIOT RIOT-OS 代码问题漏洞

RIOT RIOT-OS is a set of operating systems used in the IoT space. A code issue vulnerability exists in RIOT RIOT-OS versions prior to 2022.10, which can be exploited by an attacker to allow a device to send crafted frames that result in NULL pointer dereferences when encoding the 6LoWPAN IPHC...

openvswitch: ip proto 0 triggers incorrect handling

A flaw was found in openvswitch OVS. When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results for both kernel and userspace datapath in installing a datapath flow matching all IP protocols nwproto is wildcarded...

CVE-2022-33291

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length...

Information disclosure

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length...

RHEL 8 : openvswitch3.1 (RHSA-2023:1766)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1766 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fixe...

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0 OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow but with an incorrect action possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

...

CVE-2023-1668

A flaw was found in openvswitch OVS. When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results for both kernel and userspace datapath in installing a datapath flow matching all IP protocols nwproto is wildcarded...

CVE-2022-33291 Buffer over-read in Modem

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length...

SUSE CVE-2006-3758

inc/init.php in Archive Mode Light in MyBB aka MyBulletinBoard 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVERHTTPCLIENTIP parameter in...

SUSE CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...