Authorization Bypass

nilsteampassnet/teampass is vulnerable to authorization bypass. Sending an X-Forwarded-For client HTTP header to the getIp function allows any users with a valid API token to bypass IP address whitelist restrictions...

GHSA-FV48-HJHP-94C7 Incorrect Authorization in TeamPass

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

CVE-2021-36755

Nightscout Web Monitor aka cgm-remote-monitor 14.2.2 allows XSS via a crafted X-Forwarded-For header...

CVE-2021-36755

Nightscout Web Monitor aka cgm-remote-monitor 14.2.2 allows XSS via a crafted X-Forwarded-For header...

CVE-2021-36755: Improper Neutralization of Input During Web Page Generation

Nightscout Web Monitor aka cgm-remote-monitor 14.2.2 allows XSS via a crafted X-Forwarded-For header...

Nightscout Web Monitor 跨站脚本漏洞

Nightscout Web Monitor is an open source web monitor for healthcare that allows multiple caregivers to remotely view a patient's blood glucose data in real time. A security vulnerability exists in Nightscout Web Monitor a.k.a. cgm-remote-monitor 14.2.2 that allows XSS via a crafted x - forward -...

PT-2021-21339

Name of the Vulnerable Software and Affected Versions Nightscout Web Monitor aka cgm-remote-monitor version 14.2.2 Description The issue allows for XSS via a crafted X-Forwarded-For header. This means an attacker could potentially inject malicious scripts into the website, affecting users who...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

Cross site scripting

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-29146: Improper Neutralization of Input During Web Page Generation

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-18979

Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...

CVE-2020-18979

Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...

Cross site scripting

Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...

CVE-2020-18979

Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...

CVE-2020-18979

Halo 0.4.3 is affected by a Cross-Site Scripting (XSS) vulnerability via the X-forwarded-for header parameter. The root cause is improper handling of the X-forwarded-for header that allows injection of script code, enabling client-side code execution. Exploitation details are not provided in the ...

CVE-2020-18979: Improper Neutralization of Input During Web Page Generation

Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...

PT-2021-10258

Name of the Vulnerable Software and Affected Versions: Halo version 0.4.3 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It occurs via the X-forwarded-for Header parameter. Recommendations: For Halo version 0.4.3, consider restricting access to the X-forwarded-for...