Hide My WP < 6.2.9 - Unauthenticated SQLi

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. curl -k --location --request GET "http://localhost:10008" --header "X-Forwarded-For:...

Kaltura mwEmbed 跨站脚本漏洞

mwEmbed is Kaltura open source a Kaltura HTML5 media library . Enables you to take advantage of HTML5 and Flash's unified configuration and development API. A cross-site scripting vulnerability exists in versions prior to Kaltura mwEmbed 2.96.rc1, which stems from some unknown processing in the...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2022-2866)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an...

WP Limit Login Attempts <= 2.6.4 - IP Spoofing

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based restrictions on login forms. Set HTTPCLIENTIP or HTTPXFORWARDEDFOR as used in wplimitgetip to spoof the IP address and bypass the block...

EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2022-2884)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an...

CVE-2021-4246

A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is...

Sql injection

A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is...

CVE-2021-4246 roxlukas LMeve Login Page sql injection

A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is...

CVE-2021-4246

CVE-2021-4246 affects roxlukas LMeve Login Page; the vulnerability arises from manipulating the X-Forwarded-For parameter to trigger a SQL injection. The issue can be exploited remotely and a patch named 29e1ead3bb1c1fad53b77dfc14534496421c5b5d is recommended (no details on affected versions are ...

PT-2022-11598

Name of the Vulnerable Software and Affected Versions roxlukas LMeve affected versions not specified Description A critical issue was found in the Login Page component of roxlukas LMeve, where the manipulation of the X-Forwarded-For argument leads to sql injection. This issue can be exploited...

LMeve SQL注入漏洞

LMeve is the Industry Manager and Contribution Tracker for EVE Online. LMeve suffers from a security vulnerability that stems from the manipulation of the parameter X-Forwarded-For by some unknown functionality of its Login Page component resulting in SQL injection...

Exploit for Incorrect Authorization in Cacti

CVE-2022-46169 Cacti Blind Remote Code Execution Pre-Auth...

httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

A flaw was found in the modproxy module of httpd. The server may remove the X-Forwarded- headers from a request based on the client-side Connection header hop-by-hop mechanism...

httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

A flaw was found in the modproxy module of httpd. The server may remove the X-Forwarded- headers from a request based on the client-side Connection header hop-by-hop mechanism...

DEBIAN-CVE-2022-46169

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...

Cacti 1.2.22 unauthenticated command injection

This module exploits an unauthenticated command injection vulnerability in Cacti through 1.2.22 CVE-2022-46169 in order to achieve unauthenticated remote code execution as the www-data user. The module first attempts to obtain the Cacti version to see if the target is affected. If LOCALDATAID...

golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality...

WBCE CMS Access Control Error Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. WBCE CMS suffers from an Access Control Error vulnerability that stems from the increaseattempts function in the wbce/framework/class.login.php file in its Header Handler component not appropriately restricting too...

PT-2022-25537 · WordPress · Ip Location Block Plugin

Name of the Vulnerable Software and Affected Versions: IP Location Block Plugin affected versions not specified Description: A vulnerability was found in the IP Location Block Plugin, affecting an unknown functionality of the component HTTP Header Handler. The manipulation of the X-Forwarded-For...

PT-2022-25509 · Unknown · Banhammer Plugin

Name of the Vulnerable Software and Affected Versions: Banhammer Plugin affected versions not specified Description: A vulnerability has been found in the Banhammer Plugin, affecting the HTTP Header Handler component. The manipulation of the X-Forwarded-For argument leads to improper output...