Lucene search
+L

339 matches found

Positive Technologies
Positive Technologies
added 2026/01/27 12:0 a.m.21 views

PT-2026-4990

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve...

3.7CVSS5.9AI score0.00312EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/01/20 12:0 a.m.10 views

MiracleLinux 8 : httpd:2.4 (AXSA:2022-4399:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4399:01 advisory. httpd: modsed: Read/write beyond bounds CVE-2022-23943 httpd: modlua: Use of uninitialized value of in r:parsebody CVE-2022-22719 httpd: core:...

9.8CVSS8.5AI score0.90407EPSS
SaveExploits2References11
NVD
NVD
added 2026/01/19 9:15 p.m.12 views

CVE-2026-23848

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via X-Forwarded-For header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attackers can spoof client IPs by manipulating...

6.5CVSS0.00325EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/01/19 12:0 a.m.29 views

PT-2026-3501

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.7.71 Description MyTube is a self-hosted downloader and player for several video websites. A rate limiting bypass exists due to X-Forwarded-For header spoofing, allowing unauthenticated attackers to circumvent IP-bas...

6.5CVSS5.2AI score0.00325EPSS
SaveExploits1References8
CNNVD
CNNVD
added 2026/01/19 12:0 a.m.11 views

MyTube security vulnerability

MyTube is a video self-hosting downloader and player developed by Peifan Li. Versions of MyTube prior to 1.7.71 contained security vulnerabilities. These vulnerabilities stemmed from a flaw that allowed rate limits to be bypassed through the X-Forwarded-For header manipulation. This could enable...

6.5CVSS5.8AI score0.00325EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2026/01/09 9:36 a.m.9 views

CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers...

9.1CVSS7.1AI score0.00766EPSS
SaveExploits1References1
CVE
CVE
added 2026/01/07 9:20 a.m.23 views

CVE-2025-13694

CVE-2025-13694 affects the WordPress plugin AA Block country (versions

5.3CVSS5.7AI score0.00213EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/01/07 9:16 a.m.11 views

CVE-2025-64422

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables...

6.9CVSS6.8AI score0.00262EPSS
SaveExploits1References1
Tenable Nessus
Tenable Nessus
added 2026/01/07 12:0 a.m.18 views

Symfony Conflicting Headers Information Disclosure

The remote web application is using Symfony, a PHP framework. It is affected by an information disclosure vulnerability arising from conflicting proxy headers. When both 'Forwarded' and 'X-Forwarded-' headers are present in a request, a misconfiguration in Symfony's trusted proxy settings can...

6.4AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/01/07 12:0 a.m.13 views

PT-2026-1604

Name of the Vulnerable Software and Affected Versions AA Block Country plugin for WordPress versions up to and including 1.0.1 Description The AA Block Country plugin for WordPress is susceptible to IP Address Spoofing. The plugin relies on user-provided headers, specifically the HTTP X FORWARDED...

5.3CVSS6AI score0.00213EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/01/05 8:29 p.m.35 views

CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables...

6.9CVSS0.00262EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/01/05 8:29 p.m.9 views

EUVD-2025-206238

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables...

6.9CVSS6.3AI score0.00262EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/01/05 8:29 p.m.6 views

CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables...

6.9CVSS6.5AI score0.00262EPSS
SaveExploits1References1
CNNVD
CNNVD
added 2026/01/05 12:0 a.m.6 views

Devy Mega-Fence 安全漏洞

Devy Mega-Fence is a middleware for traffic control and online queuing from Devy Korea. A security vulnerability exists in Devy Mega-Fence versions 25.1.914 and earlier, which stems from trusting the X-Forwarded-For header value and could lead to client-side IP spoofing...

6.5CVSS6.6AI score0.00235EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2026/01/05 12:0 a.m.13 views

PT-2026-1331

Name of the Vulnerable Software and Affected Versions Coolify versions 4.0.0-beta.434 and later Description Coolify is a self-hostable tool for managing servers, applications, and databases. A rate limit on the /login endpoint can be bypassed by rotating the X-Forwarded-For header. This allows...

6.9CVSS6.5AI score0.00262EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
added 2026/01/02 3:26 p.m.17 views

Signal K Server Vulnerable to Access Request Spoofing

The SignalK access request system has two related features that when combined by themselves and with the infromation disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: clientId,...

8.8CVSS6.7AI score0.00276EPSS
SaveExploits1References5Affected Software1
EUVD
EUVD
added 2026/01/02 3:26 p.m.8 views

EUVD-2025-206135

Signal K Server Vulnerable to Access Request Spoofing...

6.3CVSS6.4AI score0.00276EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2026/01/01 6:37 p.m.33 views

CVE-2025-69203 Signal K Server Vulnerable to Access Request Spoofing

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against...

6.3CVSS0.00276EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/01/01 6:37 p.m.6 views

CVE-2025-69203 Signal K Server Vulnerable to Access Request Spoofing

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against...

6.3CVSS5.8AI score0.00276EPSS
SaveExploits1References2
OSV
OSV
added 2026/01/01 6:37 p.m.8 views

CVE-2025-69203 Signal K Server Vulnerable to Access Request Spoofing

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against...

6.3CVSS6.1AI score
SaveExploits0References4
Rows per page
Query Builder