CVE-2022-4100 WP Cerber Security <= 9.4 - IP Protection Bypass

The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the...

PT-2024-11706 · WordPress · The Ip Vault – Wp Firewall

Name of the Vulnerable Software and Affected Versions: The IP Vault – WP Firewall plugin for WordPress versions up to, and including, 1.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions...

IP Address Spoofing

serilog.enrichers.clientinfo is vulnerable to IP Spoofing. The vulnerability is caused due to a failure to validate IP address specified in X-Forwarded-For or Client-Ip headers. This allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or...

Serilog Client IP Spoofing vulnerability

Serilog before v2.1.0 contains a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses in log files by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. It is not possible to configure...

GHSA-5X5Q-CQF6-GJ8R Serilog Client IP Spoofing vulnerability

Serilog before v2.1.0 contains a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses in log files by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. It is not possible to configure...

PT-2024-31308 · Serilog · Serilog

Name of the Vulnerable Software and Affected Versions: Serilog versions prior to 2.1.0 Description: The issue allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. This enables attackers to...

CVE-2022-4532 LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass

The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2022-4532 LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass

The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

PT-2024-11697 · WordPress · Login/Registration Attempts Limit

Name of the Vulnerable Software and Affected Versions: LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress versions up to, and including, 2.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login...

ROS-20240812-05

Squid proxy server followxforwardedfor function vulnerability is related to uncontrolled recursion when processing X-Forwarded-For HTTP request headers. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

CVE-2024-40530

Pantera CRM versions 401.152 and 402.072 are affected by an authorization bypass vulnerability where an attacker can bypass IP-based access controls by manipulating the X-Forwarded-For header. The CVE-2024-40530 entry includes a CVSS v3.1 base score of 7.5 (HIGH) with NETWORK attack vector, LOW a...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

Acronis: Rate limit bypass on passport.acronis.work using X-Forwarded-For request header

The vulnerability allowed an attacker to bypass the rate limit and the restriction on attempting to log in to employee accounts using the X-Forwarded-For request header on the passport.acronis.work website...

URL Redirection To Untrusted Site ('Open Redirect')

zendframework/zendframework is vulnerable to improper handling of IP addresses. The vulnerability is due to the class not verifying if the IP address in $SERVER'REMOTEADDR' is in the trusted proxy server list before using the X-Forwarded-For header...

Authentication Bypass

ghost is vulnerable Authentication Bypass. The vulnerability is caused due to the misuse of multiple X-Forwarded-For headers with different values, which allows remote attackers to bypass the rate-limit protection mechanism. Note that the project recommends a reverse proxy to prevent this...

PT-2024-25905 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost versions 5.85.1 and earlier Description: The issue allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. The vendor recommends installing Ghost...

CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers...

CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limiting protection mechanism by using multiple X-Forwarded-For headers with different values. Affected software: Ghost, version 5.85.1 and earlier. Root cause: abuse of X-Forwarded-For headers to defeat rate-limiting. ...