SUSE CVE-2022-4303

The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based restrictions on login forms...

Improper Input Validation

Symfony is vulnerable to Improper Input Validation. The vulnerability is due to trusting the remote address when at least one trusted proxy is involved, allowing an attacker to manipulate HTTP header values...

Symfony has unsafe methods in the Request class

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintain...

BIT-MOODLE-2020-1755

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks...

SUSE CVE-2023-49792

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...

CVE-2023-49792

CVE-2023-49792 affects Nextcloud Server and Enterprise Server. When a trusted proxy is configured, the server may read an attacker’s remote address incorrectly, enabling authentication attempts to be misdirected. Affected versions include Nextcloud Server prior to 26.0.9, 27.1.4 and Nextcloud Ent...

PT-2023-8424 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 26.0.9 and 27.1.4 Nextcloud Enterprise Server versions prior to 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 Description: The issue is related to the lack of restrictions on authentication attempts,...

Nextcloud Security Breach

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. A security vulnerability exists in Nextcloud Server that stems from the fact that when a proxy is configured as a trusted proxy, the server may be tricked...

Bruteforce protection can be bypassed with misconfigured proxy

None...

Apereo CAS Authorization Issues Vulnerability

Apereo CAS is a web-based enterprise multilingual single sign-on solution. A security vulnerability exists in Apereo CAS 7.0.0-RC7 and earlier versions, which originates in the jakarta.servlet.http.HttpServletRequest.getRemoteAddr method that allows bypassing multiple authentications...

GitPython: Insecure non-multi options in clone and clone_from is not blocked

An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution...

CVE-2023-45239

A lack of input validation exists in tacplus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tacplus to inject shell commands and gain remote code execution on the tacplus server...

PT-2023-29466 · Tac Plus · Tac Plus

Name of the Vulnerable Software and Affected Versions: tac plus versions prior to commit 4fdf178 Description: A lack of input validation exists in tac plus, which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac plu...

PT-2023-12634 · WordPress · User Access Manager

Name of the Vulnerable Software and Affected Versions: User Access Manager WordPress plugin versions prior to 2.2.18 Description: The issue allows attackers to access restricted content in certain situations by prioritizing a visitor's IP from certain HTTP headers over PHP's REMOTE ADDR...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass...

PT-2023-22356 · Npm +1 · Proxy

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A remote attacker can trigger a denial of service by sending a crafted HTTP request, affecting the socket.remoteAddress variable. The usage of this...

USN-5968-1 python-git vulnerability

It was discovered that GitPython did not properly sanitize user inputs for remote URLs in the clone command. By injecting a maliciously crafted remote URL, an attacker could possibly use this issue to execute arbitrary commands on the host...

SUSE CVE-2008-3271

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a...

SUSE CVE-2010-3849

The econetsendmsg function in net/econet/afeconet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service NULL pointer dereference and OOPS via a sendmsg call that specifies a NULL value for the remote address field...

CVE-2013-10005 Infinite loop in github.com/btcsuite/go-socks

The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...