38843 matches found
(0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of proper...
(0Day) ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Alert-Info header of SIP INVITE requests. The iss...
CVE-2026-22245 Mastodon has SSRF Protection bypass
Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...
CVE-2026-22245
CVE-2026-22245 — Mastodon SSRF protection bypass . The issue affects Mastodon releases prior to 4.5.4, 4.4.11, 4.3.17 and 4.2.29, where the local/loopback access protection for outbound HTTP requests relied on a incomplete disallowed IP ranges list. An attacker could use certain IPs to trigger re...
Mastodon code issues and vulnerabilities
Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.5.4, prior to 4.4.11, prior to 4.3.17, and prior to 4.2.29, which stems from the lack of an IP address range restriction that could...
CVE-2026-21859 Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery SSRF vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it do...
CVE-2025-13694
The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTPXFORWARDEDFOR to determine the client's IP address without proper validation or considering if the server is...
WordPress AA Block country plugin <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header vulnerability
Unauthenticated IP Address Spoofing via X-Forwarded-For Header vulnerability discovered by Ivan Cese in WordPress Plugin AA Block country versions = 1.0.1...
CVE-2013-7408
F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value...
CVE-1999-0698
Denial of service in IP protocol logger ippl on Red Hat and Debian Linux...
CVE-1999-0052
IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash...
CVE-1999-0016
Land IP denial of service...
CVE-1999-0511
IP forwarding is enabled on a machine which is not a router or firewall...
CVE-1999-0001
ipinput.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service crash or hang via crafted packets...
CVE-1999-0157
Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service...
CVE-1999-0454
A remote attacker can sometimes identify the operating system of a host based on how it reacts to some IP or ICMP packets, using a tool such as nmap or queso...
CVE-1999-0104
A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2...
CVE-1999-0909
Multihomed Windows systems allow a remote attacker to bypass IP source routing restrictions via a malformed packet with IP options, aka the "Spoofed Route Pointer" vulnerability...