CVE-2025-2950
published 2025-04-18CVE-2025-2950: IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.27%
18.8th percentile
IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | i | — | — |
| ibm | i | — | — |
| ibm | i | — | — |
| ibm | i | — | — |
| lodash.unset | lodash.unset | >= 4.0.0 < 4.18.0 | 4.18.0 |
| lodash | lodash | >= 0 < 4.18.0 | 4.18.0 |
| lodash | lodash-amd | >= 0 < 4.18.0 | 4.18.0 |
| lodash | lodash-es | >= 0 < 4.18.0 | 4.18.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
ghsa6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
ghsa·2026-04-01·CVSS 6.9
CVE-2026-2950 [MEDIUM] CWE-1321 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
### Impact
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
### Patches
This issue is patched in 4.18.0.
### Workarounds
None. Upgrade to the patched version.
GHSA
GHSA-8c8c-3855-2gv4: IBM i 7
ghsa_unreviewed·2025-04-21
CVE-2025-2950 [MEDIUM] CWE-644 GHSA-8c8c-3855-2gv4: IBM i 7
IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.
No detection rules found.
No public exploits indexed.
2025-04-18
Published