36645 matches found
automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...
CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...
CVE-2026-84718
A flaw exists in the Ansible Automation Platform automation-controller where the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy. By selecting the leftmost (attacker-controlled) header value, an attacker ...
CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...
CVE-2026-84718
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
AZL-105131 CVE-2026-88831 affecting package busybox 1.36.1-27
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
DEBIAN-CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
UBUNTU-CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
EUVD-2026-85509
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
The BusyBox httpd component is vulnerable to a security bypass where IP deny rules with invalid CIDR prefix lengths fail open. The system leaves a parsed IP with a zeroed mask, causing the rule to match no clients and allowing potentially unauthorized access. To mitigate this, users should audit ...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. Mitigation Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls...
Vulnerability concealment in F5 Networks BIG-IP Access Policy Manager
F5 Networks has identified a vulnerability in BIG-IP Access Policy Manager APM. This vulnerability allows unauthorized malicious actors to execute malicious code. To do this, the malicious actor needs to send malicious network traffic to the vulnerable system. BIG-IP APM systems are only vulnerab...
CVE-2026-83602
A flaw was found in Netdata, an open-source observability tool. An unauthenticated remote attacker can bypass IP allowlist restrictions by sending PUT requests to the /api/v3/settings endpoint. This allows the attacker to write arbitrary data to a settings file, potentially leading to a Denial of...
