SUSE CVE-2007-5960

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protecti...

SUSE CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

SUSE CVE-2015-7519

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...

PT-2022-11581 · Unknown · Rsfirewall

Name of the Vulnerable Software and Affected Versions: RSFirewall affected versions not specified Description: The issue is related to how RSFirewall attempts to identify the original IP address by examining different HTTP headers. A bypass is possible due to the implementation of this...

Siemens Polarion 注入漏洞

Polarion ALM is an application lifecycle management solution that improves the software development process with a single unified solution for requirements, coding, testing and release.A security vulnerability exists in Siemens Polarion ALM, which could be exploited by attackers to spoof host...

CVE-2022-1581

The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations to vote in certain situations...

CVE-2022-1579

The function checkisloginpage uses headers for the IP check, which can be easily spoofed...

CVE-2022-2877

The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

CVE-2022-2877

CVE-2022-2877 affects the WordPress Titan Anti-spam & Security plugin prior to 7.3.1. The root cause is improper validation of HTTP headers used to verify the origin IP, allowing an attacker to bypass the plugin’s block feature by spoofing headers (e.g., X-Forwarded-For). The CVSSv3.1 vector is N...

CVE-2022-1762

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

CVE-2022-1762

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

PT-2022-14094 · WordPress · Iq Block Country

Name of the Vulnerable Software and Affected Versions: iQ Block Country WordPress plugin versions prior to 1.2.20 Description: The issue allows threat actors to bypass the block feature by spoofing HTTP headers, as the plugin does not properly check these headers to validate the origin IP address...

GHSA-594H-CX6W-P4JF Typo3 Host Header Spoofing Vulnerability

TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."...

CVE-2022-1165

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search...

waline 安全漏洞

waline is a simple commenting system with a backend support branch from Valine. A security vulnerability exists in waline, which stems from waline 1.6.1, and allows an attacker to spoof any IP address using an X-Forwarded-For submission message...

CVE-2021-36916

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a SQL injection vulnerability that stems from the hmwp get user ip function attempting to retrieve an ip address from multiple headers, including ip address headers that the user can spoof, such...

CVE-2021-29441 Authentication bypass

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

OpenAsset Digital Asset Management Input Validation Error Vulnerability

Openasset is a digital asset management software for the website building industry from Openasset UK. OpenAsset Digital Asset Management suffers from an input validation error vulnerability that allows an attacker to spoof it using the x - forward - for directive in the header. By providing a loc...

USN-4373-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. CVE-2020-6831, CVE-2020-12387, CVE-2020-12395 It wa...