50 matches found
PT-2025-2092 · Drupal · Drupal Cms +1
Name of the Vulnerable Software and Affected Versions: Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0 Description: The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can le...
CVE-2024-1504
The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupressblackholebanip function. This makes it possible for unauthenticated attacker...
Cloudflare Public Bug Bounty: Using special IPv4-mapped IPv6 addresses to bypass local IP ban
Vulnerability description not provided...
SecuPress < 2.0 - Unauthenticated Arbitrary IP Ban
The SecuPress WordPress plugin, both free and pro, versions less than 2.0, were affected by a flaw that allowed unauthenticated users to ban any IP on a site that had the plugin installed, making it impossible for them to visit the site. Effectively causing a Denial of Service DoS to the banned I...
Exploit for Path Traversal in Lanproxy_Project Lanproxy
CVE-2021-3019 CVE-2021-3019: Lanproxy directory traversal an...
What to look for when considering a WAF?
When web based applications become important components of business IP, protecting these applications is a key part of doing business. Most of IT and DevOps professionals are not thinking whether they need a Web Application Firewall WAF. Instead, they are trying to decide which WAF is right for...
Algolia: Stored xss
Hi,i have found an stored xss which is reflected at https://www.algolia.com/explorer?index=getstartedactors&tab=explorer Steps to produce: 1 Go to https://www.algolia.com/explorer?index=getstartedactors&tab=explorer and add " as an attribute and keep it at top as in screenshot1 2 Go to...
WordPress Plugin IP Ban Has Multiple Cross-Site Request Forgery Vulnerabilities
WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL. IP Ban plugin is a plugin used to prohibit certain IP addresses from accessing the blog, similar to the role of the...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the IP Ban simple-ip-ban plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 iplist, 2 useragentlist, or 3 redirecturl...
CVE-2014-9413
Multiple cross-site request forgery CSRF vulnerabilities in the IP Ban simple-ip-ban plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 iplist, 2 useragentlist, or 3 redirecturl...
CVE-2014-9413
The CVE-2014-9413 entry concerns the WordPress IP Ban plugin (simple-ip-ban) up to version 1.2.3, which has multiple CSRF vulnerabilities that let an attacker hijack an administrator’s session for requests that perform XSS via the ip_list, user_agent_list, or redirect_url parameters on the simple...
WordPress IP Ban Plugin <= 1.2.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...
WordPress IP Ban 1.2.3 CSRF / XSS
Title: WordPress 'IP Ban' plugin - CSRF/XSS Version: 1.2.3 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/simple-ip-ban/ Notified WordPress: 2014/11/27 ---------------------------------------------------------------- Description:...
Simple Ip Ban <= 1.2.3 - Multiple CSRF
The IP Ban WordPress plugin was affected by a Multiple CSRF security vulnerability...
Debian DSA-2979-1 : fail2ban - security update
Two vulnerabilities were discovered in Fail2ban, a solution to ban hosts that cause multiple authentication errors. When using Fail2ban to monitor Postfix or Cyrus IMAP logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses,...
DSA-2979-1 fail2ban - security update
Bulletin has no description...
CuteNews <= 1.4.6 (ip ban) XSS/Command Execution Exploit (adm req.)
No description provided by source. !/usr/bin/php -q ?php / CuteNews = 1.4.6 ip ban XSS / Remote Command Execution Exploit by athos - stakerathotmaildotit http://cutephp.com -=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-- Remote Command Execution...
Updated fail2ban packages fix CVE-2013-2178
Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enabl...
Debian DSA-2708-1 : fail2ban - denial of service
Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enabl...