CVE-2023-44463

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application...

WordPress plugin DoLogin Security security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

PT-2023-27914 · Gofiber · Gofiber

Name of the Vulnerable Software and Affected Versions: gofiber versions prior to 2.49.2 Description: The issue impacts users who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost...

tomcat: not including the secure attribute causes information disclosure

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

CVE-2023-34036 Forwarded header exploit with Spring HATEOAS on WebFlux

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle and possibly discard...

Unspecified Vulnerability in Emby Server

Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. Emby Server suffers from a security vulnerability that originated from allowing an attacker to perform a login bypass attack by setting th...

CVE-2023-2897

The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mo...

CVE-2022-4537

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2023-1912

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-1912

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2023-22168 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.10 MediaWiki versions 1.36.x through 1.38.x before 1.38.6 MediaWiki versions 1.39.x before 1.39.3 Description: An issue was discovered in MediaWiki where an auto-block can occur for an untrusted X-Forwarded-Fo...

PT-2023-21924 · Panasonic · Panasonic Aiseg2

Name of the Vulnerable Software and Affected Versions: Panasonic AiSEG2 versions 2.00J through 2.93A Description: The issue allows adjacent attackers to bypass authentication due to mishandling of X-Forwarded-For headers. This can be exploited by attackers to gain unauthorized access...

SUSE CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

SUSE CVE-2022-22707

In lighttpd 1.4.46 through 1.4.63, the modextforwardForwarded function of the modextforward plugin has a stack-based buffer overflow 4 bytes representing -1, as demonstrated by remote denial of service daemon crash in a non-default configuration. The non-default configuration requires handling of...

SUSE CVE-2022-32148

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the...

Parse Server 安全漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 5.4.1, which stems from a vulnerability that allows bypassing the Parse Server masterKeyIps security mechanism by setting the...

LMeve SQL注入漏洞

LMeve is the Industry Manager and Contribution Tracker for EVE Online. LMeve suffers from a security vulnerability that stems from the manipulation of the parameter X-Forwarded-For by some unknown functionality of its Login Page component resulting in SQL injection...

golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality...

PT-2022-25493 · WordPress · Iridium Intelligence Bad Ip Wp Plugin

Name of the Vulnerable Software and Affected Versions: Iridium Intelligence bad ip WP Plugin affected versions not specified Description: A vulnerability was found in the HTTP Header Handler component of the Iridium Intelligence bad ip WP Plugin. The manipulation of the X-Forwarded-For argument...

PT-2022-25549 · WordPress · Getseofix Show Visitor Ip Address Widget/Shortcode Plugin

Name of the Vulnerable Software and Affected Versions: getseofix Show Visitor IP Address Widget and Shortcode Plugin affected versions not specified Description: A problematic vulnerability was found in the HTTP Header Handler component. The manipulation of the X-Forwarded-For argument leads to...