238 matches found
CVE-2022-21839-
CVE-2022-21839- The script actually has an option to check according to the IP address and informs if the weakness exists...
CVE-2026-100390: Authentication Bypass by Spoofing
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
CVE-2026-37604
pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...
PT-2026-96935
pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTP CLIENT IP and HTTP X FORWARDED FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout...
CVE-2026-37604: Inconsistent Interpretation of HTTP Requests
pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...
CVE-2026-37604
The pH7Builder (pH7 Social Dating CMS) through version 18.2.0 is vulnerable to an IP-based throttling bypass. The application resolves client IP addresses in _protected/framework/Ip/Ip.class.php using the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying if the request originates ...
CVE-2026-37604
pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...
CVE-2026-82967
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface...
CVE-2026-82967 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface...
CVE-2026-82967
IBM Guardium Data Protection 12.2 is affected by an authentication bypass vulnerability that allows an unauthenticated remote attacker to bypass IP-based access controls and gain access to the Guardium management interface. The flaw effectively nullifies the IP-restriction layer that would otherw...
CVE-2026-82967 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface...
EUVD-2026-83412
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface...
PT-2026-93809
Name of the Vulnerable Software and Affected Versions @fastify/proxy-addr versions 3.0.0 through 5.1.0 Description This plugin, used to determine a request's client address behind trusted reverse proxies, incorrectly handles trust subnets written in IPv4-mapped IPv6 notation when an IPv4-sized...
SUSE CVE-2026-90711
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...
AZL-101775 CVE-2026-90711 affecting package python-tensorboard 2.16.2-6
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attack...
PT-2026-98422
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...
PT-2026-91873
Name of the Vulnerable Software and Affected Versions proxy-addr versions 1.1.0 through 2.0.7 Description This Node.js module, which determines a request's client address behind trusted reverse proxies and supports Express req.ip and req.ips, contains a flaw where trust subnets written in...
Outbound Public IP Addresses Used by Veeam Data Cloud
Purpose This article lists the outbound public IP addresses that Veeam Data Cloud uses when connecting from the cloud to infrastructure that a customer hosts and controls, for example a Microsoft Azure Key Vault used for BYOK encryption. These addresses are not used for inbound connections made t...