Description

Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost.

Remediation

References

CVE-2005-2678

Related Vulnerabilities

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-1914)

WordPress Plugin Billplz for WooCommerce Unspecified Vulnerability (3.10)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31799)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3414)

WordPress Plugin YITH WooCommerce Ajax Search Security Bypass (1.6.9)

Severity

Medium

Classification

CVE-2005-2678

Tags

Missing Update Known Vulnerabilities