Unspecified vulnerability in Scytl sVote (CNVD-2021-16362)

Scytl sVote is a Spanish Scytl open source application. Provides voters to vote online. A security vulnerability exists in Scytl sVote 2.1, which can be exploited by attackers to inject incorrect IP addresses into logs...

CVE-2019-25023

An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header which can be manipulated client-side is used for the internal application logs, an attacker can inject wrong IP addresses into these logs...

CVE-2019-25023

An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header which can be manipulated client-side is used for the internal application logs, an attacker can inject wrong IP addresses into these logs...

CVE-2019-25023

The CVE-2019-25023 issue affects Scytl sVote 2.1, where an attacker can manipulate the X-Forwarded-For header to inject arbitrary IP addresses into internal application logs due to the logs using that header. The root cause is trusting a client-controlled header for logging. Connected sources (Re...

CVE-2021-21273

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

PYSEC-2021-131

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

Cross site request forgery (csrf)

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

GHSA-V936-J8GP-9Q3P Open redirects on some federation and push requests

Impact Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the...

CVE-2021-21273

Synapse (matrix-synapse, Python/pypi) contains a vulnerability in versions before 1.25.0 where requests to user-provided domains were not restricted to external IPs when computing the key validity for third-party invite events and push notifications. This could allow requests to internal infrastr...

CVE-2021-21273 Open redirects on some federation and push requests

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

Matrix Synapse Input Validation Error Vulnerability

Matrix Synapse is an implementation of a matrix management server from the Matrix Foundation in the UK. A security vulnerability exists in Synapse that stems from a request to a user-provided domain being unrestricted by an external IP address when calculating key validity for third-party...

Bitcoins, Blockchains, and Botnets

A recent piece of malware from a known crypto mining botnet campaign has started leveraging Bitcoin blockchain transactions in order to hide its backup C2 IP address. It's a simple, yet effective, way to defeat takedown attempts...

The vulnerability of the mod_remoteip and mod_rewrite modules in the Apache HTTP Server allows a hacker to replace an IP address.

The vulnerability of the modremoteip and modrewrite modules in the Apache HTTP Server is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to perform IP address substitution attacks...

Shopify: Blind Stored XSS in shopify internal Parquet Viewer

A blind stored XSS vulnerability was found in a Shopify internal tool called Parquet Viewer. On February 14th, an XSS payload fired on an employee's computer. The vulnerable page was accessed locally on the employee's machine. The employee's IP address and user-agent indicate they were using a Ma...

GHSA-43F8-P5W3-5M25 vrana/adminer vulnerable to SSRF by connecting to privileged ports

Impact All users are affected. Patches Unsuccessfully patched by 0fae40fb, included in version 4.4.0. Patched by 35bfaa75, included in version 4.7.8. Workarounds Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin. References...

vrana/adminer vulnerable to SSRF by connecting to privileged ports

Impact All users are affected. Patches Unsuccessfully patched by 0fae40fb, included in version 4.4.0. Patched by 35bfaa75, included in version 4.7.8. Workarounds Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin. References...

GHSA-X5R2-HJ5C-8JX6 SSRF in adminer

Impact Users of Adminer versions bundling all drivers e.g. adminer.php are affected. Patches Patched by ccd2374b, included in version 4.7.9. Workarounds Use a single driver version e.g. adminer-mysql.php. Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or...

SSRF in adminer

Impact Users of Adminer versions bundling all drivers e.g. adminer.php are affected. Patches Patched by ccd2374b, included in version 4.7.9. Workarounds Use a single driver version e.g. adminer-mysql.php. Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or...

Bcamarneiro macfromip Injection Vulnerability

Bcamarneiro macfromip is an American Bcamarneiro personal organization to get MAC address from LAN IP address. Provides obtaining MAC addresses from LAN IP addresses. An injection vulnerability exists in macfromip. The vulnerability stems from macfromip.js lacking proper validation of user input...

CVE-2020-8807

In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel...