31984 matches found
CVE-2025-66508 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies TrustedProxies = 0.0.0.0/0, allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls...
CVE-2025-66508
1Panel (GitHub/Governance: 1Panel) contains a vulnerability where Gin’s default proxy trust config (TrustedProxies = 0.0.0.0/0) causes X-Forwarded-For headers to be trusted, letting attackers bypass IP-based access controls (AllowIPs, API whitelists, localhost checks) by sending X-Forwarded-For: ...
CVE-2025-66508 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies TrustedProxies = 0.0.0.0/0, allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls...
CVE-2025-66508 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies TrustedProxies = 0.0.0.0/0, allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls...
PT-2025-49975
Name of the Vulnerable Software and Affected Versions 432ES-IG3 Series A versions affected versions not specified Description A security issue exists that can lead to a denial-of-service condition in the GuardLink® EtherNet/IP Interface. A manual power cycle is required to restore device...
OpenBMCS 代码问题漏洞
OpenBMCS is a building management and control system from OpenBMCS Australia. A code issue vulnerability exists in OpenBMCS version 2.4 that stems from a server-side request forgery issue with the ip parameter, which could lead to internal network enumeration and session hijacking...
PT-2025-50154
Name of the Vulnerable Software and Affected Versions phpIPAM version 1.7.3 Description A cross-site scripting XSS issue exists in the Request IP form within phpIPAM. This allows attackers to inject arbitrary web scripts or HTML code through the instructions parameter of the...
CVE-2025-61078
Cross-site scripting XSS vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint...
PT-2025-50247
Name of the Vulnerable Software and Affected Versions Selea Targa IP OCR-ANPR Camera affected versions not specified Description The Selea Targa IP OCR-ANPR Camera has an unauthenticated command injection issue in the utils.php file. This allows remote attackers to execute arbitrary shell command...
PT-2025-50233
Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4 Description The software contains an unauthenticated Server-Side Request Forgery SSRF issue. This allows attackers to bypass firewalls and perform service and network enumeration on the internal network. Attackers can...
Rockwell Automation 432ES-IG3 Series A 安全漏洞
The Rockwell Automation 432ES-IG3 Series A is a safety I/O module from Rockwell Automation. A denial of service vulnerability exists in the Rockwell Automation 432ES-IG3 Series A, which can be exploited by an attacker to cause a denial of service...
F5 Networks BIG-IP : Expat vulnerability (K000158115)
The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000158115 advisory. libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that ...
Siemens Interniche IP-Stack
SUMMARY Multiple Industrial products are affected by a vulnerability in the Interniche IP-Stack. The affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to...
phpIPAM 安全漏洞
phpIPAM is phpIPAM open source a set of open source PHP and MySQL based IP address management applications IPAM. A security vulnerability exists in phpIPAM v1.7.3, which stems from improper neutralization of the instructions parameter and could lead to cross-site scripting attacks...
CVE-2025-65513
CVE-2025-65513 affects fetch-mcp v1.0.2 and earlier. The vulnerability is Server-Side Request Forgery (SSRF) that allows bypassing private IP validation to reach internal network resources. Reported root cause involves the is_ip_private logic in fetch-mcp server code (notably in the MCP fetch-ser...
CVE-2025-61078
Cross-site scripting XSS vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint...
PT-2025-49712
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.0-next-20230707-00001-g84e2cad7f979 Description The Linux kernel contains a flaw within the ipv6 vti module, specifically in the decode session6 function, that can lead to a slab-use-after-free condition. Thi...
CVE-2025-65513
fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery SSRF vulnerability, which allows attackers to bypass private IP validation and access internal network resources...
⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More
It's been a week of chaos in code and calm in headlines. A bug that broke the internet's favorite framework, hackers chasing AI tools, fake apps stealing cash, and record-breaking cyberattacks — all within days. If you blink, you'll miss how fast the threat map is changing. New flaws are being...
