IBM i Content Neutralization Misconduct Vulnerability

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i suffers from a Content Neutralization Malpractice vulnerability that originates from a HTTP header Content Neutralization Malpractice, which can be exploited by a...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

Host Header Injection

Overview croogo/croogo is an Open Source CMS built for everyone. Affected versions of this package are vulnerable to Host Header Injection in the feed.rss component, which takes the content of the -H argument in a request and passes it through to the element in a response without filtering. An...

GHSA-847X-X4JG-6GF4 croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

CVE-2025-2950

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Security Bulletin: IBM i is vulnerable to a host header injection attack due to improper neutralization of HTTP header content by IBM Navigator for i [CVE-2025-2950].

Summary IBM i is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in the...

CVE-2025-2950

IBM i (versions 7.3, 7.4, 7.5, and 7.6) is affected by a host header injection vulnerability due to improper neutralization of HTTP header content in IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to alter the domain/IP, potentially causing unexpected b...

CVE-2025-2950 IBM i improper HTTP header neutralization

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

IBM i 安全漏洞

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i suffers from a Content Neutralization Malpractice vulnerability that originates from a HTTP header Content Neutralization Malpractice, which can be exploited by a...

CVE-2024-29643

CVE-2024-29643 affects croogo v3.0.2 and is due to Host header injection in the feed.rss component. The vulnerability occurs when the feed.rss code passes the HTTP Host header content into a response element (e.g., a link) without proper filtering, enabling an attacker to influence redirect-like ...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Croogo 安全漏洞

Croogo is Croogo open source a set of CakePHP framework based on the development of content management system CMS. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo version 3.0.2 security vulnerabilities , the...

PT-2025-17297 · Croogo · Croogo

Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Host Header Injection

@react-router/express, @remix-run/express is vulnerable to Host header injection. The vulnerability exists due to improper validation of the Host and X-Forwarded-Host headers, allowing attackers to spoof the request URL by injecting a pathname into the port section of the header...