CWE-348: Use of Less Trusted Source
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...2.7 Low
- libretranslateLibreTranslate - IP Spoofing via X-Forwarded-For Header6.9 Medium
- go-chi chigo-chi chi before 5.3.0 IP Spoofing via RealIP Middleware6.9 Medium
- canonical ubuntu 20.04 lts, ubuntu 22.04 lts, ubuntu 24.04 lts +2 more +4 moreCanonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment9.0 Critical
- proxysqlProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL10.0 Critical
- apache apisixApache APISIX: wolf-rbac plugin Identity Spoofing2.3 Low
- honojs honoHono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest4.8 Medium
- litestar-org litestarLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header5.9 Medium
- offlineimapOfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication...6.5 Medium
- jasonlovesdoggo caddy-defenderCaddy Defender trusted proxy client IP bypass8.2 High
- hestiacpHestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header8.7 High
- cleanuparrCleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled9.8 Critical
- systemdIn nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted...6.4 Medium
- bulwarkmail webmailBulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery8.7 High
- openclawOpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification6.3 Medium
- milesmcc shynetShynet before 0.14.0 allows Host header injection in the password reset flow.6.4 Medium
- krajowa izba rozliczeniowa szafir sdk webURL (HTTP Origin) call location spoofing in Szafir SDK Web5.1 Medium
- wwbn avideoAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()5.3 Medium
- @clerk fastifyFastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function6.1 Medium
- raythaHeader Poisoning in Raytha CMS7.5 High
- gvectors wpdiscuzwpDiscuz before 7.6.47 - IP Address Spoofing in getIP()6.9 Medium
- meshtastic firmwareIn Meshtastic, an attacker can spoof licensed amateur flag for a node8.2 High
- bunIn Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed...5.9 Medium
- aaextensions aa block countryAA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header5.3 Medium
- pbootcmsPbootCMS Header handle.php get_user_ip less trusted source6.9 Medium
- kde connect information-exchange protocolIn the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to...4.3 Medium
- lukegus termixTermix' official Docker image contains an authentication bypass vulnerability9.2 Critical
- ricoh company, ltd. streamline nxRICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If...2.3 Low
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 moreMovable Type contains an issue with use of less trusted source. If exploited, tampered email to...6.9 Medium
- ricoh company, ltd. streamline nx v3 pc clientRICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less...2.0 Low
- fabiolb fabioFabio allows HTTP clients to manipulate custom headers it adds9.1 Critical
- digital arts inc. i-filterThe optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern...6.9 Medium
- hitachi infrastructure analytics advisor, ops center analyzer +1 moreBypass Connection Restriction Vulnerability in Hitachi Ops Center Analyzer6.5 Medium
- retoolRetool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN...7.1 High
- ssl.comSSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes...6.4 Medium
- freepbx apiPassbolt API before 5, if the server is misconfigured (with an incorrect installation process and...2.1 Low
- cyberark privileged access managerPVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4...4.2 Medium
- typo3 oidcTYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)4.2 Medium
- postgresqlPostgreSQL libpq retains an error message from man-in-the-middle3.1 Low
- openrefineOpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand8.1 High
- wp-buy limit login attempts (spam protection), limit login attempts +1 moreLimit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- traefikHTTP client can remove the X-Forwarded headers in Traefik9.8 Critical
- devfelixmoira limit login attempts plus, limit login attempts project login attempts plus, devfelixmoira limit login attempts plus – wordpress limit login attempts by felix +2 moreLimit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- msoftplugins security, antivirus, firewall – s.a.f, security antivirus firewall +1 moreSecurity, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- miniorange web application firewall, cyberlord92 web application firewall – website security +1 moreWeb Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- youtag two-factor authentication (formerly ip vault), two-factor authentication +1 moreIP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- serilog, serilog-contrib serilog-enrichers-clientinfo +1 moreSerilog Client IP Spoofing vulnerability6.5 Medium
- krut1 login and registration attempts limitLOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass6.5 Medium
- unitecms unlimited elements for elementor, unlimited-elements unlimited elements for elementor \(free widgets\, addons\, templates\) +1 moreUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass5.3 Medium
- solidwp solid securityWordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability3.7 Low
- Show moreLoading…