CVE-2025-54425

CVE-2025-54425 affects Umbraco’s Delivery API. When public access is restricted by an API key header and output caching is enabled, the cache does not vary by the API key header, potentially returning cached responses to users without a valid API key if a prior request with a valid key occurred. ...

CVE-2025-54425 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such...

CVE-2025-54425 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such...

CVE-2025-54425 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such...

Cobalt Strike Beacon delivered via GitHub and social media

Introduction In the latter half of 2024, the Russian IT industry, alongside a number of entities in other countries, experienced a notable cyberattack. The attackers employed a range of malicious techniques to trick security systems and remain undetected. To bypass detection, they delivered...

Silicon Labs Zigbee EmberZNet SDK 安全漏洞

Silicon Labs Zigbee EmberZNet SDK is a software development kit for developing Zigbee networks from Silicon Labs, Inc. A security vulnerability exists in the Silicon Labs Zigbee EmberZNet SDK that stems from high traffic resulting in a message delivery failure that could lead to a denial of servi...

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats allows a perpetrator to enhance their privileges.

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

Missing Authorization

Overview Umbraco.Cms.Api.Delivery is a presentation layer for the Umbraco CMS Delivery API. Affected versions of this package are vulnerable to Missing Authorization in IOutputCachePolicy.CacheRequestAsync. An attacker can access sensitive information by sending requests without a valid API key a...

Umbraco Delivery API allows for cached requests to be returned with an invalid API key

Impact Umbraco's content delivery API can be restricted from public access such that an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance...

GHSA-75VQ-QVHR-7FFR Umbraco Delivery API allows for cached requests to be returned with an invalid API key

Impact Umbraco's content delivery API can be restricted from public access such that an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance...

BIT-GITLAB-2025-4439 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks...

CVE-2024-58265

The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery...

The vulnerability of the configuration of the Version Control System (VCS) of the Continuous Integration and Delivery Application Framework (CI/CD) tool JetBrains TeamCity allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the TeamCity VCS configuration in continuous integration and delivery systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information from a remote location...

PT-2025-31370 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions 13.0.0 through 13.9.2 Umbraco versions 15.0.0 through 15.4.1 Umbraco versions 16.0.0 through 16.1.0 Description: Umbraco’s content delivery API can be restricted to require an API key in a header for authorization. Output...

The vulnerability of the GraphQL interface of the Continuous Integration and Delivery application system JetBrains TeamCity, which allows a hacker to perform a CSRF attack

The vulnerability of the GraphQL interface of the Continuous Integration and Delivery application system CI/CD from JetBrains TeamCity is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

Post SMTP Plugin Flaw Allowed Subscribers to Take Over Admin Accounts

If you're running a WordPress site and rely on the Post SMTP plugin for email delivery, there's something…...

A week in security (July 21 – July 27)

A list of topics we covered in the week of July 21 to July 27 of 2025 Last week on Malwarebytes Labs: Steam games abused to deliver malware once again Watch out: Instagram users targeted in novel phishing campaign Age verification: Child protection or privacy risk? iPhone vs. Android: iPhone user...

GHSA-97F8-H76H-F297 Duplicate Advisory: Unauthenticated Nonce Increment in snow

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7g9j-g5jg-3vv3. This link is maintained to preserve external references. Original Description The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby...

Duplicate Advisory: Unauthenticated Nonce Increment in snow

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7g9j-g5jg-3vv3. This link is maintained to preserve external references. Original Description The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby...

📄 Malicious Windows Script Host JScript File

This Metasploit module creates a Windows Script Host WSH JScript .js file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Malicious Windows Script Host JScript .js File', 'Description' = %q Th...