1439 matches found
CVE-2023-2897 Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mo...
CVE-2023-2897: Use of Less Trusted Source
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mo...
PT-2023-22057 · WordPress · Brizy – Page Builder
Name of the Vulnerable Software and Affected Versions: Brizy Page Builder plugin for WordPress versions up to, and including, 2.4.18 Description: The issue arises from an implicit trust of user-supplied IP addresses in the X-Forwarded-For HTTP header, which is used to validate allowed IP addresse...
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality...
CVE-2022-4537
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
CVE-2022-4537
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
Design/Logic Flaw
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
CVE-2022-4537 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
CVE-2022-4537: Use of Less Trusted Source
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
Cross-Site Scripting (XSS)
microweber/microweber is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the X-Forwarded-For header, which allows an attacker to inject and execute arbitrary JavaScript into the browser...
USN-6038-1: Go vulnerabilities
It was discovered that the Go net/http module incorrectly handled Transfer-Encoding headers in the HTTP/1 client. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. CVE-2022-1705 It was discovered that Go did not properly manage memory under certain...
Fedora 38 : mediawiki (2023-9d6ab5ebf2)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9d6ab5ebf2 advisory. https://lists.wikimedia.org/hyperkitty/list/mediawiki- [email protected]/message/6UQBHI5FWLATD7QO7DI4YS54U7XSSLAN/ Tenable has extracted the...
CVE-2023-1912
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2023-17334 · WordPress · Limit Login Attempts
Name of the Vulnerable Software and Affected Versions: Limit Login Attempts plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting via the lock logging feature due to insufficient input sanitization and output escaping. This allo...
Limit Login Attempts < 1.7.2 - Unauthenticated Stored XSS
The plugin does not sanitize and escape the IP address retrieved from headers such as X-Forwarded-For when the "Site Connection" settings is set to "From behind a reversy proxy", which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks Setup: As admin, set the...
CVE-2023-1912: Improper Neutralization of Input During Web Page Generation
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header
microweber/microweber prior to 1.3.3 is vulnerable to stored cross-site scripting XSS via the X-Forwarded-For header. This was fixed in version 1.3.3...
MediaWiki < 1.35.10, 1.36.x < 1.38.6, 1.39.x < 1.39.3 Multiple Vulnerabilities - Windows
MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; ifdescripti...
PT-2023-17309
Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.3.3 Description The issue is related to stored Cross-site Scripting XSS in the GitHub repository microweber/microweber. This occurs via the X-Forwarded-For header. Recommendations For versions prior to...
