34 matches found
CVE-2026-100390
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
CVE-2026-100390
Zoraxy versions 3.2.3 through 3.3.4 are vulnerable to client IP spoofing due to a failure to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. This allows unauthenticated attackers connecting over IPv6 to supply arbitrary X-Forwarded-For values. Consequently, a...
CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
EUVD-2026-87327
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
CVE-2026-100390: Authentication Bypass by Spoofing
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...
SUSE CVE-2026-72809
SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...
EUVD-2026-57410
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy...
PT-2026-85345
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3mp7-4rh5-jrv9. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth...
SUSE CVE-2026-46415
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...
CVE-2026-46415: Improper Access Control
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...
EUVD-2020-10891
Malware in sbrugna...
EUVD-2022-7640
Malicious code in bioql PyPI...
CVE-2013-10005
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...
Zend-Session session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
GHSA-96C6-M98X-HXJX Zend-Session session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
ZendFramework Potential Proxy Injection Vulnerabilities
Zend\Session\Validator\RemoteAddr and Zend\View\Helper\ServerUrl were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name. In Zend\Session\Validator\RemoteAddr, if the client is behind a proxy server, the...
GHSA-MG7H-9QFX-4R83 ZendFramework Potential Proxy Injection Vulnerabilities
Zend\Session\Validator\RemoteAddr and Zend\View\Helper\ServerUrl were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name. In Zend\Session\Validator\RemoteAddr, if the client is behind a proxy server, the...
Zendframework session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
GHSA-62F6-H68R-3JPW Zendframework session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...