CVE-2019-17213

The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...

Design/Logic Flaw

The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...

CVE-2019-17213

The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...

CVE-2019-17213

CVE-2019-17213 affects the WebARX plugin for WordPress (version 1.3.0). The connected records confirm an unauthenticated stored cross-site scripting (XSS) vulnerability that can be triggered via the URI or the X-Forwarded-For HTTP header. The root cause is an XSS flaw in how input in the request ...

CVE-2019-17213: Improper Neutralization of Input During Web Page Generation

The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...

CVE-2019-17240: Improper Restriction of Excessive Authentication Attempts

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

Design/Logic Flaw

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...

CVE-2016-10990: Improper Neutralization of Input During Web Page Generation

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...

CVE-2018-16118: Improper Neutralization of Special Elements used in an OS Command

A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header...

ok.ru: [okmedia.insideok.ru] Web Cache Poisoing & XSS

XSS and Web Cache Poisoning at .insideok.ru via X-Forwarded-Host header Web Cache Poisoing & XSS okmedia.insideok.ru...

Mail.ru: [authdl.mail.ru] Spoofing IP address

Client IP address could be spoofed via X-Forwarded-For headers in authdl.mail.ru. While no direct impact were identified, this issue could potentially lead to issues with logging, limitations or ABF protection...

CVE-2019-9733

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass: an unauthenticated user can exploit the X-Forwarded-For header to login as the admin by abusing the access-admin reset path, bypassing IP whitelists and potentially obtaining tokens to control all artifacts and repositories. Root cau...

PT-2019-19828

Name of the Vulnerable Software and Affected Versions JFrog Artifactory version 6.7.3 Description An issue in JFrog Artifactory allows an unauthenticated user to login with the default credentials of the access-admin account by providing a X-Forwarded-For HTTP header to the request, bypassing the...

CVE-2019-9733: Undefined Security Weakness

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

JFrog Artifactory Administrator Authentication Bypass Exploit

JFrog Artifactory versions prior to 6.8.7 suffer from an administrative access bypass vulnerability due to relying on an X-Forwarded-For header. JFrog Artifactory Administrator Authentication Bypass Introduction ============ JFrog Artifactory https://jfrog.com/artifactory/ is a popular universal...

SQL injection vulnerability in X-forwarded-for header of joomla! jdo*** component

joomla! is an open source content management system CMS. A SQL injection vulnerability exists in the X-forwarded-for header of the joomla! jdo component. The vulnerability allows attackers to obtain sensitive information about the database...

McAfee ePO 5.9.1 - Registered Executable Local Access Bypass Vulnerability

Exploit for windows platform in category web applications Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass Exploit Author: @leonjza Vendor Homepage: https://www.mcafee.com/ Software Link: https://www.mcafee.com/enterprise/en-us/products/epolicy-orchestrator.html Version:...

McAfee ePO 5.9.1 Registered Executable Local Access Bypass

Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass Date: 2019-03-07 Exploit Author: @leonjza Vendor Homepage: https://www.mcafee.com/ Software Link: https://www.mcafee.com/enterprise/en-us/products/epolicy-orchestrator.html Version: ePO v5.9.1 Tested on: Windows Server 2012...

McAfee ePO 5.9.1 - Registered Executable Local Access Bypass

Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass Date: 2019-03-07 Exploit Author: @leonjza Vendor Homepage: https://www.mcafee.com/ Software Link: https://www.mcafee.com/enterprise/en-us/products/epolicy-orchestrator.html Version: ePO v5.9.1 Tested on: Windows Server 2012...