CVE-2023-44463

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application...

CVE-2023-44463

CVE-2023-44463 affects pretix versions before 2023.7.1. The issue arises from incorrect parsing of configuration files, causing the application to trust unchecked X-Forwarded-For headers even when not configured to do so. This can enable IP address spoofing by users of the application and may aff...

CVE-2023-4549

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

Cross site scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2023-4549 DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2023-4631 DoLogin Security < 3.7 - IP Spoofing

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

PT-2023-29951 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7 Description: The issue allows IP spoofing by using headers such as the X-Forwarded-For to retrieve the IP address of the request. Recommendations: For versions prior to 3.7, update to...

WordPress plugin DoLogin Security Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-4631: Undefined Security Weakness

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CVE-2023-4549: Undefined Security Weakness

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

PT-2023-29565

Name of the Vulnerable Software and Affected Versions DoLogin Security WordPress plugin versions prior to 3.7 Description The issue arises from improper sanitization of IP addresses from the X-Forwarded-For header, allowing attackers to conduct Stored XSS attacks through the WordPress login form...

CVE-2023-4965

A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been...

Open redirect

A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been...

CVE-2023-4965

CVE-2023-4965 affects phpipam 1.5.1 via the Header Handler; manipulating the X-Forwarded-Host header leads to an open redirect, exploitable remotely and publicly disclosed (VDB-239732). Documented impact signals low to no confidentiality/integrity/availability effects, with no explicit patch/vers...

CVE-2023-4965: URL Redirection to Untrusted Site

A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been...

PT-2023-31278

Name of the Vulnerable Software and Affected Versions phpipam version 1.5.1 Description A vulnerability was found in the component Header Handler of phpipam. The manipulation of the argument X-Forwarded-Host leads to open redirect. This issue can be exploited remotely. Recommendations For phpipam...

Rate Limit Bypass

Azuracast is vulnerable to Rate Limit Bypass. The vulnerability arises because the existing rate limiting functionality trusts the arbitrary user input coming from the X-Forwarded-For and Client IP header. The vulnerability could allow an attacker to brute force a user password...

CVE-2023-41338

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...