66 matches found
CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-
CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical- Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in tiene una falla fácilmente explotable, no autenticada y accesible por red que permite comprometer el sistema a través de HTTP. Las versiones compatibles...
CVE-2023-4279
CVE ID : CVE-2023-4279 漏洞类型 : IP 地址欺骗 描述 : 该插件从可能不可信的请求头中获取客户端 IP 地址，攻击者可以操纵该值，从而隐藏恶意流量的来源。 复现步骤 : 1. 在用户活动日志 设置中，启用“记录用户的 IP 地址”选项并保存设置。 2. 在浏览器中运行以下代码，并注意后端显示的 IP 地址已被伪造。 await fetch"/wp-login.php", "headers": "content-type": "application/x-www-form-urlencoded", "Client-Ip": "8.8.8.8", , "body"...
Security Bulletin: IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (CVE-2026-7366)
Summary IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall CVE-2026-7366 Vulnerability Details CVEID:CVE-2026-7366 DESCRIPTION: IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 throug...
CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...
CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...
Astra Linux – Vulnerability in mod-wsgi
A vulnerability was discovered in modwsgi. The X-Client-IP header is not removed from a request sent from a trusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application. The condition necessary to remove the X-Client-IP header is missing...
GHSA-786W-P5PM-CVGH phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...
EUVD-2026-67862
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-7366
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...
CVE-2026-7366
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...
CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...
CVE-2026-22201
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTPCLIENTIP or HTTPXFORWARDEDFOR headers to spoof their IP address and circumvent...
CVE-2026-22201 wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTPCLIENTIP or HTTPXFORWARDEDFOR headers to spoof their IP address and circumvent...
CVE-2020-37056
The CVE-2020-37056 entry concerns Crystal Shard http-protection 0.2.0, where an IP-spoofing flaw allows bypass of protection middleware by crafting headers. Specifically, attackers can set consistent values in X-Forwarded-For, X-Client-IP, and X-Real-IP to defeat checks and gain unauthorized acce...
EUVD-2018-11199
Malware in sbrugna...
EUVD-2007-1957
Malware in sbrugna...
EUVD-2007-1169
Malware in sbrugna...
EUVD-2007-0965
Malware in sbrugna...