Lucene search
+L

211 matches found

Kitploit
Kitploit
added 2026/09/07 7:30 p.m.6 views

CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and including 1.26.2 ships REVERSEPROXYTRUSTEDPROXIES = in its default config. If you turn on reverse-proxy login, that wildcard means every source IP is treated as a trusted proxy, so anyone who can reach the port can send an X-WEBAUTH-USER head...

9.8CVSS8.2AI score0.02755EPSS
SaveExploits7References1
RedhatCVE
RedhatCVE
added 2026/09/01 8:40 a.m.7 views

CVE-2026-42395

A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of service for user logins. Mitigation To mitigate thi...

6.5CVSS7.1AI score0.00181EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/01 8:40 a.m.8 views

CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to...

4.3CVSS5.7AI score0.00193EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.9 views

PT-2026-84535

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers. This allows attackers to spoof the client address used by the enforceRateLimit function. By...

8.7CVSS5.2AI score0.00261EPSS
SaveExploits0References6
Tenable Nessus
Tenable Nessus
added 2026/08/29 12:00 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-42008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that hos...

4.3CVSS7.1AI score0.00193EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/08/29 12:00 a.m.14 views

Linux Distros Unpatched Vulnerability : CVE-2026-42395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The logi...

4.3CVSS7.2AI score0.00181EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/28 12:16 p.m.6 views

AZL-98265 CVE-2026-42395 affecting package dovecot 2.3.20-1

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS7.1AI score0.00181EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/28 12:16 p.m.9 views

ALPINE-CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS7.1AI score0.00181EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 12:16 p.m.10 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS0.00193EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 12:16 p.m.9 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS0.00181EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/28 12:16 p.m.8 views

AZL-98325 CVE-2026-42008 affecting package dovecot 2.3.20-1

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/08/28 10:12 a.m.11 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2026/08/28 10:12 a.m.13 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0
CVE
CVE
added 2026/08/28 10:12 a.m.27 views

CVE-2026-42395

CVE-2026-42395 affects Dovecot (OX Dovecot by Open-Xchange, per the advisory reference). A host listed as a trusted proxy can send forwarding information containing a NUL byte , which crashes the login process on the next login attempt, causing degradation or denial of service for logins. Deploym...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/28 10:12 a.m.33 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS0.00181EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 10:12 a.m.12 views

EUVD-2026-67677

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 10:12 a.m.12 views

EUVD-2026-67673

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/08/28 10:12 a.m.15 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/28 10:12 a.m.36 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS0.00193EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/28 10:12 a.m.28 views

CVE-2026-42008

CVE-2026-42008 is an authentication bypass in Dovecot (Open-Xchange fork) where forwarding information from a trusted proxy host is not kept separate from Dovecot's own authentication fields. A malicious or compromised trusted proxy host can inject an internal authentication field, allowing it to...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
Rows per page
Query Builder