WordPress limit-login-attempts-reloaded Security Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress limit-login-attempts-reloaded plugin prior to versi...

CVE-2020-35590: Improper Restriction of Excessive Authentication Attempts

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...

CVE-2020-28856

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...

Design/Logic Flaw

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...

CVE-2020-28856

Summary (CVE-2020-28856) OpenAsset Digital Asset Management (DAM) prior to 12.0.20 (Cloud) / 11.4.10 (On‑premise) improperly determines the originating IP from HTTP requests, enabling spoofing via the X-Forwarded-For header (e.g., 127.0.0.1) and bypassing IP‑based access controls. Affected versio...

CVE-2020-28856: Authentication Bypass by Spoofing

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...

Jenkins 2.235.3 - 'X-Forwarded-For' Stored XSS

Exploit Title: Jenkins 2.235.3 - 'X-Forwarded-For' Stored XSS Date: 11/12/2020 Exploit Author: gx1 Vendor Homepage: https://www.jenkins.io/ Software Link: https://updates.jenkins-ci.org/download/war/ Version: '. To understand how remote build trigger works, have a look at this post:...

PT-2020-17356

Name of the Vulnerable Software and Affected Versions limit-login-attempts-reloaded plugin versions prior to 2.17.4 for WordPress Description The issue allows a bypass of rate limits per IP address because the X-Forwarded-For header can be forged. When the plugin is configured to accept an...

PT-2020-17043

Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management DAM versions 12.0.19 and earlier Description The issue allows attackers to spoof the HTTP request's originating IP address by using the X-Forwarded-For header, potentially bypassing IP address-based access...

OpenAsset Digital Asset Management IP Access Control Bypass

Title: IP access control bypass Product: OpenAsset Digital Asset Management by OpenAsset Vendor Homepage: https://www.openasset.com/ Vulnerable Version: 12.0.19 Cloud 11.2.1 On-premise Fixed Version: 12.0.20 Cloud 11.4.10 On-premise CVE Number: CVE-2020-28856 Author: Jack Misiura from The Missing...

HTTP Response Splitting

Overview github.com/gin-gonic/gin is a package that implements a HTTP web framework called gin. Affected versions of this package are vulnerable to HTTP Response Splitting. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. Remediatio...

Authorization Bypass

expressjs-ip-control is vulnerable to authorization bypass. An unauthenticated user is able to bypass the IP whitelist using the X-Forwarded-For HTTP header, resulting in unauthroized access to restricted resources and services...

CVE-2020-27621

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an...

Facebook WhatsApp Information Leakage Vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, and more. WhatsApp Android has a security...

CVE-2020-27621: Undefined Security Weakness

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an...

PT-2020-16728 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.0 Description: The issue concerns the FileImporter extension, which failed to properly attribute user actions to a specific user's IP address. It would report the IP address of an internal server instead, by...

CVE-2020-1902

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP...

CVE-2020-19451

SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...

CVE-2020-19451

SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...

Sql injection

SQL injection exists in the jdownloads 3.2.63 component for Joomla! via comjdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter...