2295 matches found
CVE-2017-12650
CVE-2017-12650 affects the WordPress Loginizer plugin prior to version 1.3.6. The root cause is improper sanitization of the X-Forwarded-For HTTP header, which is forwarded to the lz_selectquery() function and can be exploited to perform a blind SQL injection via the login workflow. Impact stated...
CVE-2017-12650
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header...
PT-2017-12629
Name of the Vulnerable Software and Affected Versions Loginizer plugin versions prior to 1.3.6 Description The issue exists due to SQL Injection in the Loginizer plugin for WordPress. This is exploited via the X-Forwarded-For HTTP header. Recommendations For versions prior to 1.3.6, update to...
CVE-2017-12650: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header...
Open Redirect
rails is vulnerable to open redirects. The X-Forwarded-Host HTTP header is always trusted, allowing a malicious user to pass an invalid host header to redirect a user to a malicious URL...
PT-2017-19170
Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.17 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to the "/include/stat/stat.php" API endpoint in a para action...
CVE-2017-9764: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...
CVE-2017-7528
Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...
[SECURITY] [DSA 3890-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3890-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 21, 2017 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-3890-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2016-10329
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
Command injection
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
CVE-2016-10329
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
CVE-2016-10329
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
CVE-2016-10329
Affected product: Synology Photo Station (prior to version 6.5.3-3226). Vulnerability: Command injection in login.php that allows remote attackers to execute arbitrary code through shell metacharacters in a crafted X-Forwarded-For header. Impact: Remote code execution with high risk (as noted by ...
PT-2017-7866
Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.5.3-3226 Description A command injection issue exists, allowing remote attackers to execute arbitrary code by including shell metacharacters in a crafted X-Forwarded-For header. Recommendations For...
CVE-2016-10329: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
SQL injection vulnerability in the save.php file of TreeHole's external link system
TreeHole Outbound Linking System is a free and open source outbound linking system. Treehole external link system save.php file SQL injection vulnerability , the vulnerability stems from x-forwarded-for failure to adequately filter , an attacker can exploit the vulnerability to access or modify...
Synology Photo Station Security Bypass Vulnerability
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security bypass vulnerability exists in Synology Photo Station versions prior to 6.3-2958. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending an...