CVE-2002-2231

Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL in a photo URL or 2 an X-Forwarded-For: header...

CVE-2002-2231: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL in a photo URL or 2 an X-Forwarded-For: header...

Sql injection

SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...

CVE-2007-2556

SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...

CVE-2007-2556

Nuked-klaN is affected by CVE-2007-2556 via SQL injection in the web layer. Reported vulnerability allows remote attackers to inject SQL commands through HTTP headers (X-Forwarded-For) and relates to the /nk/ URI; DSquare cites 1.7.7 / SP4.4 as vulnerable and notes a Referer-header vector. The NV...

CVE-2007-2556

SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...

Sql injection

Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...

CVE-2007-2537

Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...

CVE-2007-2537: Undefined Security Weakness

Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...

CVE-2007-2556: Undefined Security Weakness

SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...

CVE-2006-7013: Undefined Security Weakness

QueryString.php in Simple Machines Forum SMF 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address. NOTE: the...

CVE-2006-6679

Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header...

CVE-2006-6679

The issue affects chetcpasswd prior to version 2.4, where ACL checks rely on the X-Forwarded-For header. This header spoofing allows remote attackers to gain unauthorized access. Root cause: authentication/authorization logic trusts X-Forwarded-For for client status in IP ACLs. Documented impact:...

CVE-2006-6679

Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header...

CVE-2006-6684

Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long X-Forwarded-For HTTP header. NOTE: The provenance of this information is unknown; the details are obtained...

CVE-2006-6684

The CVE-2006-6684 entry relates to a heap-based buffer overflow in Pedro Lineu Orso chetcpasswd prior to version 2.4. The vulnerability can be triggered by a long X-Forwarded-For HTTP header, allowing remote attackers to cause an application crash and, per the description, possibly execute arbitr...

CVE-2006-6684: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long X-Forwarded-For HTTP header. NOTE: The provenance of this information is unknown; the details are obtained...

CVE-2006-6679: Incorrect Authorization

Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header...

PT-2006-7280 · Pedro Lineu Orso · Chetcpasswd

Name of the Vulnerable Software and Affected Versions: Pedro Lineu Orso chetcpasswd versions prior to 2.4 Description: The issue allows remote attackers to gain unauthorized access by spoofing the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL. This is due to th...

DEBIAN-CVE-2006-4674

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php...