CVE-2020-13485

The Knock Knock plugin for Craft CMS is affected up to version 1.2.7 (pre-1.2.8). The root cause is a flawed IP whitelisting mechanism that trusts the X-Forwarded-For header, allowing an attacker to bypass IP-based access controls. Impact: potential unauthorized access due to bypassed whitelist; ...

CVE-2020-13485

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

U.S. Dept Of Defense: XSS via X-Forwarded-Host header

Summary: The █████ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a...

PT-2020-13568

Name of the Vulnerable Software and Affected Versions Knock Knock plugin versions prior to 1.2.8 Description The issue allows IP Whitelist bypass via an X-Forwarded-For HTTP header. This means that an attacker can potentially bypass the IP whitelist by manipulating the X-Forwarded-For header in...

CVE-2020-13485: Incorrect Comparison

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

TeamPass Information Disclosure Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in the REST API functionality in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability to bypass IP address whitelisting restrictions with the help of the...

CVE-2020-12477

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

Design/Logic Flaw

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

CVE-2020-12477

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

CVE-2020-12477: Incorrect Authorization

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

PT-2020-13136

Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36 Description The issue allows any user with a valid API token to bypass IP address whitelist restrictions. This is achieved via an X-Forwarded-For client HTTP header to the getIp function. Recommendations For TeamPass...

Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.

Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...

mediawiki -- multiple vulnerabilities

Mediawikwi reports: T285159, CVE-2023-PENDING SECURITY: X-Forwarded-For header allows brute-forcing autoblocked IP addresses. T326946, CVE-2020-36649 SECURITY: Bundled PapaParse copy in VisualEditor has known ReDos. T330086, CVE-2023-PENDING SECURITY: OATHAuth allows replay attacks when MediaWiki...

squid: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of service

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via...

ZendTo IP Address Spoofing Vulnerability

ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An IP address spoofing vulnerability exists in lib/NSSDropbox.php in versions prior to ZendTo 5.22-2 Beta. An attacker can exploit this vulnerability via the...

CVE-2020-8984

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

CVE-2020-8984

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

Design/Logic Flaw

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

CVE-2020-8984

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

CVE-2020-8984

CVE-2020-8984 affects ZendTo’s lib/NSSDropbox.php, prior to version 5.22-2 Beta. The vulnerability enables IP address spoofing via the X-Forwarded-For header. The connected documents confirm the affected component and root cause (IP spoofing) but do not provide exploit details or explicit remedia...