Skip to content
OpenAdvisories

Weakness (CWE)

CWE-348: Use of Less Trusted Source

Base Draft

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Source: MITRE CWE-348

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-45410 Public exploit

    HTTP client can remove the X-Forwarded headers in Traefik

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it sho…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Alpine Go
  • Medium 5.3
    CVE-2022-4539 Public exploit

    Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

    The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restr…

    cyberlord92 Web Application Firewall – website security Web / CMS
  • Unscored —
    CVE-2022-31813 Public exploit

    mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism

    Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine