CVE-2022-4100 WP Cerber Security <= 9.4 - IP Protection Bypass

The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the...

PT-2024-11706 · WordPress · The Ip Vault – Wp Firewall

Name of the Vulnerable Software and Affected Versions: The IP Vault – WP Firewall plugin for WordPress versions up to, and including, 1.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions...

IP Address Spoofing

serilog.enrichers.clientinfo is vulnerable to IP Spoofing. The vulnerability is caused due to a failure to validate IP address specified in X-Forwarded-For or Client-Ip headers. This allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or...

GHSA-5X5Q-CQF6-GJ8R Serilog Client IP Spoofing vulnerability

Serilog before v2.1.0 contains a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses in log files by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. It is not possible to configure...

Serilog Client IP Spoofing vulnerability

Serilog before v2.1.0 contains a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses in log files by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. It is not possible to configure...

PT-2024-31308 · Serilog · Serilog

Name of the Vulnerable Software and Affected Versions: Serilog versions prior to 2.1.0 Description: The issue allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. This enables attackers to...

ROS-20240823-02

A vulnerability in the Host Authorization Middleware Action Pack component of the Ruby on Rails software platform is related to the creation of "X-Forwarded-Host" headers in combination with certain "authorized host" formats. host." Exploitation of the vulnerability could allow an attacker acting...

CVE-2022-4532 LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass

The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2022-4532 LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass

The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

PT-2024-11697 · WordPress · Login/Registration Attempts Limit

Name of the Vulnerable Software and Affected Versions: LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress versions up to, and including, 2.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login...

ROS-20240812-05

Squid proxy server followxforwardedfor function vulnerability is related to uncontrolled recursion when processing X-Forwarded-For HTTP request headers. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-41432

CVE-2024-41432 affects Likeshop up to 2.5.7.20210811. The issue is IP spoofing via forged X-Forwarded or Client-IP headers, enabling attackers to bypass admin login lockouts, spoof server requests, and impersonate other IPs tied to user sessions. No explicit fixes or patches are provided in the c...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

CVE-2024-40530

Pantera CRM versions 401.152 and 402.072 are affected by an authorization bypass vulnerability where an attacker can bypass IP-based access controls by manipulating the X-Forwarded-For header. The CVE-2024-40530 entry includes a CVSS v3.1 base score of 7.5 (HIGH) with NETWORK attack vector, LOW a...

CVE-2024-40530

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

Acronis: Rate limit bypass on passport.acronis.work using X-Forwarded-For request header

The vulnerability allowed an attacker to bypass the rate limit and the restriction on attempting to log in to employee accounts using the X-Forwarded-For request header on the passport.acronis.work website...

CVE-2024-41801 OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration

OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProje...