PT-2025-21650

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.6.2 Description: The issue allows a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FAB SAFE REDIRECT HOS...

Amazon Linux 2 : pcs (ALAS-2025-2853)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2853 advisory. Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the...

Medium: pcs

Issue Overview: Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrar...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

Retool 安全漏洞

Retool is a platform from Retool, Inc. Any content can be developed using the code, design, debug, review, and deploy features. A security vulnerability exists in Retool versions prior to 3.196.0 that stems from host header injection allowed when the BASEDOMAIN environment variable is not set...

PT-2025-20603 · Retool · Retool

Name of the Vulnerable Software and Affected Versions: Retool self-hosted versions prior to 3.196.0 Description: The issue allows for Host header injection when the BASE DOMAIN environment variable is not set, enabling manipulation of the HTTP host header. Recommendations: For versions prior to...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

CVE-2025-47424

CVE-2025-47424 affects Retool (self-hosted) prior to 3.196.0. The underlying issue is a Host header injection when BASE_DOMAIN is not set, allowing manipulation of the HTTP Host header. The vulnerability is described with a potential impact on confidentiality/integrity (per the CVSS metrics) and ...

IBM i Content Neutralization Misconduct Vulnerability

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i suffers from a Content Neutralization Malpractice vulnerability that originates from a HTTP header Content Neutralization Malpractice, which can be exploited by a...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

GHSA-847X-X4JG-6GF4 croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Host Header Injection

Overview croogo/croogo is an Open Source CMS built for everyone. Affected versions of this package are vulnerable to Host Header Injection in the feed.rss component, which takes the content of the -H argument in a request and passes it through to the element in a response without filtering. An...

croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Security Bulletin: IBM i is vulnerable to a host header injection attack due to improper neutralization of HTTP header content by IBM Navigator for i [CVE-2025-2950].

Summary IBM i is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in the...