Linux Distros Unpatched Vulnerability : CVE-2025-3875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From head...

Progress Hybrid Data Pipeline Server 安全漏洞

Progress Hybrid Data Pipeline Server is a data pipeline server from Progress USA. A security vulnerability exists in Progress Hybrid Data Pipeline Server versions prior to 4.6.2.2978, which stems from the possibility that the X-Forwarded-For header may be spoofed, potentially leading to...

SUSE CVE-2025-48865

Fabio is an HTTPS and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and...

Broadcom Spring Cloud Gateway Server 环境问题漏洞

Broadcom Spring Cloud Gateway Server is a managed service and API gateway for the VMware Tanzu Platform for Cloud Foundry from Broadcom, Inc. A security vulnerability exists in Broadcom Spring Cloud Gateway Server that originates from forwarding X-Forwarded-For and Forwarded headers from untruste...

CVE-2022-2877

The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

CVE-2022-1579

The function checkisloginpage uses headers for the IP check, which can be easily spoofed...

CVE-2021-41114

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the...

CVE-2018-13257

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2024-13553

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.7.9. This is due to the plugin using the Host header to determine if the plugin is in a playground environment. This makes it...

CVE-2024-13553

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.7.9. This is due to the plugin using the Host header to determine if the plugin is in a playground environment. This makes it...

PT-2025-14091 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.9 Description: The issue allows for privilege escalation via account takeover. This is due to the plugin using the Host header to determine if...

IBM Aspera Shares 安全漏洞

IBM Aspera Shares is a Web application from International Business Machines IBM. An input validation error vulnerability exists in IBM Aspera Shares, which stems from improper validation of the "Client-IP" header, and can be exploited by an attacker to spoof its IP address written to a log file...

PT-2025-5783 · Ibm · Ibm Aspera Shares

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6 Description: The issue allows an attacker to spoof their IP address, which is then written to log files, due to improper verification of Client-IP headers. Recommendations: For versions 1.9....

Red Hat OpenShift Service Mesh 安全漏洞

Red Hat OpenShift Service Mesh is a suite of platforms for connecting, managing, and monitoring microservices-based applications from Red Hat USA. A security vulnerability exists in Red Hat OpenShift Service Mesh versions 2.6.3 and 2.5.6, which stems from improper cleanup of x-forwarded-for heade...

PT-2025-49306

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.27.0 Description The software is a C++11 single-file header-only cross-platform HTTP/HTTPS library. A flaw exists where attacker-controlled HTTP headers can affect server-visible metadata, logging, and...

Authentication Bypass

Apache ZooKeeper is vulnerable to Authentication Bypass. The vulnerability is due to weak client IP address validation in IPAuthenticationProvider, where the Admin Server trusts the X-Forwarded-For HTTP header by default, allowing attackers to spoof their IP address and bypass IP-based...

DEBIAN-CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

OESA-2024-2249 rubygem-puma security update

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Security Fixes: Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies such as X-Forwarded-For by providing a underscore version...

PT-2024-29568 · Unknown +1 · Openproject +1

Name of the Vulnerable Software and Affected Versions: OpenProject versions prior to 14.3.0 Description: The issue allows an attacker to redirect to a remote host to initiate a phishing attack against an OpenProject user's account by using a forged HOST header in the default configuration of...