PT-2019-9465

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a SQL Injection vulnerability. It is located in the /user/logincheck.php file and can be exploited via the X-Forwarded-For HTTP header. Recommendations For zzcms version 8.3, consider...

CVE-2018-17412: Improper Neutralization of Special Elements used in an SQL Command

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

Junos OS: Stateless firewall filter ignores IPv6 extension headers (JSA10905)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability which may allow IPv6 packets that should have been blocked to be forwarded. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid122241; scriptversion"1.3";...

CVE-2019-0005

On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected...

PT-2019-6068 · Wayang · Wayang-Cms

Name of the Vulnerable Software and Affected Versions: Wayang-CMS version 1.0 Description: A cross-site scripting XSS issue in the index.php file of Wayang-CMS allows attackers to execute arbitrary web scripts or HTML by adding a specially crafted X-Forwarded-For field to the header. This can...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

Sql injection

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2018-19468

HuCart 5.7.4 is vulnerable to SQL injection in get_ip() (system/class/helper_class.php) via the X-Forwarded-For HTTP header, exploitable at user/index.php?load=login&act=act_login. Affected component: get_ip() function; root cause: insufficient validation/filtering of HTTP header data leading to ...

HuCart SQL Injection Vulnerability

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version of the system/class/helperclass.php file of the 'getip' function there is a SQL injection vulnerability , the vulnerability stems from the program fails to HTTP packet header data security filtering , remote attacker...

CVE-2018-19468: Improper Neutralization of Special Elements used in an SQL Command

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

PT-2018-14970

Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description The issue concerns a SQL injection in the get ip function located in system/class/helper class.php. This occurs via the X-Forwarded-For HTTP header when accessing the "user/index.php?load=login&act=act login"...

DEBIAN-CVE-2016-2125

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users...

HackerOne: Denial of service via cache poisoning

An attacker can persistently block access to any/all redirects on www.hackerone.com by using cache poisoning with the X-Forwarded-Port or X-Forwarded-Host headers to redirect users to an invalid port. To replicate: curl -H 'X-Forwarded-Port: 123'...

xunfeng anti-csrf decorator cross-site request forgery vulnerability

xunfeng is a vulnerability rapid response and asset scanning system for enterprise intranets. anti-csrf decorator is one of the CSRF processing components. The anti-csrf decorator in xunfeng version 0.2.0 has a cross-site request forgery vulnerability that originates from the views/lib/AntiCSRF.p...

CVE-2018-16832

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

PT-2018-13765

Name of the Vulnerable Software and Affected Versions xunfeng version 0.2.0 Description The issue allows an attacker to modify the configuration via a Flash file. This is possible because the views/lib/AntiCSRF.py file can overwrite the request.host value with the content of the X-Forwarded-Host...

CVE-2018-16832: Cross-Site Request Forgery (CSRF)

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

Red Hat CloudForms Management Engine CRLF Injection Vulnerability

Red Hat CloudForms Management Engine is a management engine for IaaS cloud service solutions. A CRLF injection vulnerability in Ansible Tower for Red Hat CloudForms Management Engine allows remote attackers to submit a special X-Forwarded-For packet header request to obtain sensitive information...