GHSA-RXG9-HGQ7-8PWX Header spoofing in caddy-geo-ip

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

Design/Logic Flaw

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A security vulnerability exists in Caddy-geo-ip GeoIP version 0.6.0, which stems from a vulnerability that allows an attacker to spoof the source IP address of his/her source IP address via the X-Forwarded-For header when using t...

CVE-2023-50463: Authentication Bypass by Spoofing

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-50463

The CVE-2023-50463 issue affects the caddy-geo-ip (GeoIP) middleware for Caddy 2 up to version 0.6.0. The vulnerability arises when trust_header X-Forwarded-For is used: an attacker can spoof their source IP address by manipulating X-Forwarded-For, potentially bypassing protection mechanisms such...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

SUSE-SU-2023:4698-1 Security update for squid

This update for squid fixes the following issues: - CVE-2023-49285: Fixed buffer over read bug on HTTP Message processing flow bsc1217813 - CVE-2023-49286: Fixed Denial of Service vulnerability in helper process management bsc1217815 - Fix X-Forwarded-For Stack Overflow bsc1217654...

CVE-2023-5560

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks...

WordPress plugin WP-UserOnline security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in the...

CVE-2023-5560: Improper Neutralization of Input During Web Page Generation

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks...

PT-2023-32176 · WordPress · Wp-Useronline

Name of the Vulnerable Software and Affected Versions: WP-UserOnline WordPress plugin versions prior to 2.88.3 Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the X-Forwarded-For header before its content ...

PT-2023-7760

Name of the Vulnerable Software and Affected Versions Squid versions 2.6 through 2.7.STABLE9 Squid versions 3.1 through 5.9 Squid versions 6.0.1 through 6.5 Description The issue is related to an Uncontrolled Recursion bug in the Squid caching proxy, which may allow a remote client to perform a...

CVE-2023-45132

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

Design/Logic Flaw

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132 IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132: Protection Mechanism Failure

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

Improper Authorization

pretix is vulnerable to Improper Authorization. An attacker is able to exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable pretix instance. This request could contain a malicious X-Forwarded-For header that spoofs the attacker's IP address. If the pretix instanc...