imgurl跨站脚本漏洞

imgurl is a simple, pure graph bed program developed using PHP + SQLite 3. A cross-site scripting vulnerability exists in imgURL version 2.31, which allows attackers to trigger cross-site scripting via the X-Forwarded-For HTTP header...

Gin-Gonic Gin Environmental Vulnerabilities

Gin-Gonic Gin is a Go-based framework for rapidly building web applications from the Gin-Gonic team. github.com/gin-gonic/gin A security vulnerability exists in all versions, which stems from the ability to spoof a client's IP by setting the X-Forwarded-For header...

PT-2020-16997 · Sentrifugo · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: The issue allows for Stored Cross-Site Scripting XSS by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator views logs, the payload is executed. This...

PT-2020-16728 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.0 Description: The issue concerns the FileImporter extension, which failed to properly attribute user actions to a specific user's IP address. It would report the IP address of an internal server instead, by...

CVE-2020-19451

SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...

Knock Knock Security Restriction Bypass Vulnerability

Pixel & Tonic Craft CMS is the United States Pixel & Tonic company's set of content management system CMS.Knock Knock is one of the access rights management plugin. A security vulnerability exists in Knock Knock versions prior to 1.2.8 for Pixel & Tonic Craft CMS. The vulnerability can be exploit...

TeamPass Information Disclosure Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in the REST API functionality in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability to bypass IP address whitelisting restrictions with the help of the...

squid: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of service

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via...

ZendTo IP Address Spoofing Vulnerability

ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An IP address spoofing vulnerability exists in lib/NSSDropbox.php in versions prior to ZendTo 5.22-2 Beta. An attacker can exploit this vulnerability via the...

CVE-2019-17213

The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...

zzcms SQL Injection Vulnerability (CNVD-2019-13260)

ZZCMS is a content management system CMS by the ZZCMS team in China. A SQL injection vulnerability exists in the /user/logincheck.php file in ZZCMS version 8.3. The vulnerability can be exploited by a remote attacker to execute SQL commands with the help of the 'X-Forwarded' parameter in the HTTP...

PT-2019-6068 · Wayang · Wayang-Cms

Name of the Vulnerable Software and Affected Versions: Wayang-CMS version 1.0 Description: A cross-site scripting XSS issue in the index.php file of Wayang-CMS allows attackers to execute arbitrary web scripts or HTML by adding a specially crafted X-Forwarded-For field to the header. This can...

HuCart SQL Injection Vulnerability

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version of the system/class/helperclass.php file of the 'getip' function there is a SQL injection vulnerability , the vulnerability stems from the program fails to HTTP packet header data security filtering , remote attacker...

WordPress Loginizer SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A security vulnerability in WordPress Loginizer's handling of the X-Forwarded-For HTTP packet header allows remote attackers ...

CVE-2017-12650

SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header...

Synology Photo Station Command Injection Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A command injection vulnerability exists in the login.php file in Synology Photo Station versions prior to 6.5.3-3226. A remote attacker can exploit the vulnerability to...

Parse HTTP X-Forwarded Header Attack Redirect

Document Title: =============== Parse HTTP X-Forwarded Header Attack Redirect References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1944 PoC Video: https://www.youtube.com/watch?v=gpYe-hun8Xk Vulnerability Magazine:...

UBUNTU-CVE-2014-9494

RabbitMQ before 3.4.0 allows remote attackers to bypass the loopbackusers restriction via a crafted X-Forwareded-For header...

PT-2007-1292 · Simple Machines · Simple Machines Forum

Name of the Vulnerable Software and Affected Versions: Simple Machines Forum SMF versions 1.0.7 and earlier Simple Machines Forum SMF version 1.1rc2 and earlier Description: The issue allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP...