977 matches found
CVE-2020-28365
Sentrifugo 3.2 allows Stored Cross-Site Scripting XSS vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by...
Pivotal RabbitMQ < 3.3.4 Security Bypass Vulnerability
According to its self-reported version, the version of Pivotal RabbitMQ running on the remote web server is prior to 3.3.4. It is, therefore, affected by security bypass vulnerability. An unauthenticated, remote attacker could bypass security restrictions, caused by the improper handling of...
CVE-2020-35590
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...
Design/Logic Flaw
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...
CVE-2020-35590
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...
CVE-2020-28856
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...
Design/Logic Flaw
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...
CVE-2020-28856
Summary (CVE-2020-28856) OpenAsset Digital Asset Management (DAM) prior to 12.0.20 (Cloud) / 11.4.10 (On‑premise) improperly determines the originating IP from HTTP requests, enabling spoofing via the X-Forwarded-For header (e.g., 127.0.0.1) and bypassing IP‑based access controls. Affected versio...
Jenkins 2.235.3 - 'X-Forwarded-For' Stored XSS
Exploit Title: Jenkins 2.235.3 - 'X-Forwarded-For' Stored XSS Date: 11/12/2020 Exploit Author: gx1 Vendor Homepage: https://www.jenkins.io/ Software Link: https://updates.jenkins-ci.org/download/war/ Version: '. To understand how remote build trigger works, have a look at this post:...
OpenAsset Digital Asset Management IP Access Control Bypass
Title: IP access control bypass Product: OpenAsset Digital Asset Management by OpenAsset Vendor Homepage: https://www.openasset.com/ Vulnerable Version: 12.0.19 Cloud 11.2.1 On-premise Fixed Version: 12.0.20 Cloud 11.4.10 On-premise CVE Number: CVE-2020-28856 Author: Jack Misiura from The Missing...
HTTP Response Splitting
Overview github.com/gin-gonic/gin is a package that implements a HTTP web framework called gin. Affected versions of this package are vulnerable to HTTP Response Splitting. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. Remediatio...
Authorization Bypass
expressjs-ip-control is vulnerable to authorization bypass. An unauthenticated user is able to bypass the IP whitelist using the X-Forwarded-For HTTP header, resulting in unauthroized access to restricted resources and services...
CVE-2020-19451
SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...
Sql injection
SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...
CVE-2020-19451
SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...
CVE-2020-19451
CVE-2020-19451 is a SQL injection in the Joomla! jdownloads 3.2.63 component, exploitable via com_jdownloads/helpers/jdownloadshelper.php in updateLog and triggered by the X-Forwarded-For header. Affected software is jdownloads 3.2.63 for Joomla!. The vulnerability is documented across NVD, Red H...
Exploit for Improper Restriction of Excessive Authentication Attempts in Bludit
CVE-2019-17240https://www.cvedetails.com/cve/CVE-2019-17240...
Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass
Exploit Title : Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass Exploit Author : Halis Duraki @0xduraki Date : 2020-05-28 Product : http-protection Crystal Shard Product URI : https://github.com/rogeriozambon/http-protection Version : http-protection = 0.2.0 CVE : N/A About the product...
IP Whitelisting Bypass
verbb/knock-knock is vulnerable to IP Whitelisting Bypass. It is due to the use of a flawed IP-Whitelisting mechanism of getting User IP , allowing bypass of IP whitelisting through X-Forwarded-For header manipulation...