367 matches found
CVE-2017-16541
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...
proxy server seeing Android traffic from client IP
Your proxy server may see the client IP from Android devices where as iOS it sees and expects the subnet IP of the NS. How to filter traffic using the Subnet IP address for Android Devices?...
Restrict access to certain URLs based on the Source client IP
Restrict certain IPs who should not be able to access certain URLs when they hit the Load balancing virtual server on the NetScaler...
CVE-2016-4793
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...
X-Forwarded-For Header Insert
Use Case X-Forwarded-For header can be used to pass the Client IP information to the backend server. When HTTP request contains X-Forwarded-For header, the values will be replaced with single client IP address. If there is no X-Forwarded-For header, it will be added and assigned with the client I...
Radancy: Application error message
Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...
CakePHP Framework 3.2.4 - IP Spoofing
CakePHP Framework 3.2.4 - IP Spoofing ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP Spoofing...
CakePHP Framework 3.2.4 - IP Spoofing
Exploit for php platform in category web applications ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP...
CakePHP Framework 3.2.4 - IP Spoofing
============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP Spoofing Vulnerability 3.1.11 2.8.1 2.7.10 2.6.12 II...
WordPress Huge-IT Image Gallery 1.8.9 Plugin - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and...
How to forward client IP to back-end server using "x-forwarded-for" header on Citrix ADC
To forwardClient IP to Back-End Server Using "x-forwarded-for" Header...
Converting iRules to NetScaler Policies - X-Forwarded For Header Based Persistence
Use Case X-Forwarded-For HTTP header indicates the path where the request came in through and it can have multiple IP addresses as well. You can define persistence based on the value of X-Forwarded-For header received while processing the request on load balancing vserver. F5iRules Name:...
WordPress WP Limit Login Attempts Plugin SQL Injection Vulnerability
WordPress is the WordPress Software Foundation of a set of PHP language development of blogging platform, the platform supports PHP and MySQL server set up a personal blog site.WP Limit Login Attempts is one of the login protection mechanism allowing bloggers to limit the number of times you can...
CVE-2015-6829
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 X-Forwarded-For or 2 Client-IP HTTP header...
UFONet - DDoS attacks via Web Abuse (XSS/CSRF)
UFONet - is a tool designed to launch DDoS attacks against a target, using 'Open Redirect' vectors on third party web applications, like botnet. See this links for more info: - CWE-601:Open Redirect - OWASP:URL Redirector Abuse Main features: --version show program's version number and exit -v,...
DouPHP SQL注入一枚
简要描述： 注入 详细说明： 依然是getip的问题， guestbook.php:102行 if $rec == 'insert' / 跨站请求伪造CSRF的防御 / if $firewall-checktoken$POST'token' / html安全过滤器 / $POST = $firewall-doufilter$POST; $ip = $dou-getip; $addtime = time; $vcode = $check-iscaptcha$POST'vcode' ? strtoupper$POST'vcode' : ''; / 检查IP是否频繁留言 /...
MyBulletinBoard (MyBB) <= 1.2.3 - Remote Code Execution Exploit
No description provided by source. !/usr/bin/php ?php errorreportingEALL ^ ENOTICE; http://www.milw0rm.com/exploits/2012 They corrected not all a lot of SQL requests which use the ipaddress, with $db-escapestring. They don't corrected the function this is a choice ... the bad and they forgot to...
MyBulletinBoard (MyBB) <= 1.2.2 (CLIENT-IP) SQL Injection Exploit
No description provided by source. !/usr/bin/perl LOGO Mybb = 1.2.2 Remote SQL Injecton Exploit v.2.0 uused: SQL CLIENTIP vulnerability !need: Mysql = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в...
RunCMS Newbb_plus <= 0.92 Client IP Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; $mw = new MainWindowtitle = UnderWHAT?! ; $mw-geometry '420x383' ; $mw-resizable0,0; $mw-Label-text = '', -font = 'Verdana 8',-foreground='red'-pack; $mw-Label-text = 'Newbbplus =...