GHSA-PQG7-V6WH-3PFP TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For or X-Real-IP header from incoming requests before calling r.SetXForwarded. This allows an authenticated Tailscale user to inject arbitrary X-Forwarded-For values that are forwarded verbatim to backend...

Command Execution Vulnerability in the Backend of Ruijie Unified Internet Behavior Management and Audit System

Ruijie Unified Internet Behavior Management and Auditing System is an Internet behavior management and auditing product independently developed by Ruijie Networks. A command execution vulnerability exists in the backend of Ruijie Unified Internet Behavior Management and Audit System, which can be...