CVE-2024-0787 Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...

PT-2024-15819 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpIPAM version 1.5.1 Description: The issue allows an attacker to bypass the IP block mechanism, enabling brute force attacks on user accounts, including the admin account, by utilizing the 'X-Forwarded-For' header. This is due to the get us...

SUSE CVE-2024-49214

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality...

CVE-2023-47802

Synology CVE-2023-47802 affects Synology Camera Firmware BC500/TC500 prior to version 1.0.7-0298. Root cause: improper neutralization of special elements used in OS commands in IP block functionality, enabling OS Command Injection. Impact: remote authenticated administrators can run arbitrary com...

CVE-2023-47802

A vulnerability regarding improper neutralization of special elements used in an OS command 'OS Command Injection' is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following mode...

CVE-2024-35920

A vulnerability was found in the Linux kernel's MediaTek VCodec driver, caused by the absence of a lock to protect the decoder context list ctxlist. This issue can lead to a NULL pointer dereference in the vpudecipihandler function, resulting in a kernel panic. Mitigation Mitigation for this issu...

UBUNTU-CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35919

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpuencipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920 media: mediatek: vcodec: adding lock to protect decoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920 media: mediatek: vcodec: adding lock to protect decoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920

CVE-2024-35920 refers to a Linux kernel issue in the media: mediatek: vcodec driver. The root cause is a race/NULL-pointer risk in vpu_dec_ipi_handler when the decoder context list (ctx_list) could be deleted due to SCP IP block behavior. The patch adds a lock around ctx_list to prevent illegal a...

CVE-2024-35919 media: mediatek: vcodec: adding lock to protect encoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpuencipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35919

CVE-2024-35919: The Linux kernel vulnerability involves a race/NULL dereference in media: mediatek: vcodec code where vpu_enc_ipi_handler may access a deleted ctx_list, potentially leading to a NULL pointer dereference when SCP IP block behavior deletes the list. A lock was added to protect the e...

CVE-2021-4226 RSFirewall < 1.1.25 - IP Block Bypass

RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented...

WordPress RSFirewall! plugin <= 1.1.24 - IP Block Bypass vulnerability

IP Block Bypass vulnerability discovered by Daniel Ruf in WordPress RSFirewall! plugin versions = 1.1.24. Solution Update the WordPress RSFirewall! plugin to the latest available version at least 1.1.25...

UBUNTU-CVE-2019-12472

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...

PFTP Server 8.0f Lite - textfield Local SEH Buffer Overflow Exploit

Exploit for windows platform in category dos / poc Exploit Title: PFTP Server 8.0f lite SEH bypass technique tested on Win7x64 Date: 8-29-2015 Software Link: http://www.heise.de/download/the-personal-ftp-server-78679a5e8458e9faa7c5564617bdd4c4-1440883445-267104.html Exploit Author: Robbie Corley...

PFTP Server 8.0f Lite - textfield Local Buffer Overflow (SEH) (PoC)

Exploit Title: PFTP Server 8.0f lite SEH bypass technique tested on Win7x64 Date: 8-29-2015 Software Link: http://www.heise.de/download/the-personal-ftp-server-78679a5e8458e9faa7c5564617bdd4c4-1440883445-267104.html Exploit Author: Robbie Corley Contact: [email protected] Website: CVE:...