28 matches found
PYSEC-2026-125
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the setsessioncookiesecure beforerequest handler in src/pyload/webui/app/init.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted prox...
CVE-2026-40594 pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the setsessioncookiesecure beforerequest handler in src/pyload/webui/app/init.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted prox...
GHSA-MP82-FMJ6-F22V pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Summary The setsessioncookiesecure beforerequest handler in src/pyload/webui/app/init.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the global Flask configuration SESSIONCOOKIESECURE on every request...
PT-2025-49823
An XSS vulnerability in pxc portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...
EUVD-2008-3647
Malware in sbrugna...
EUVD-2008-3648
Malware in sbrugna...
EUVD-2014-3113
Malware in sbrugna...
EUVD-2009-1472
Malware in sbrugna...
EUVD-2009-5008
Malware in sbrugna...
EUVD-2014-4611
Malware in sbrugna...
EUVD-2019-1114
Malware in sbrugna...
EUVD-2021-15658
Malware in sbrugna...
EUVD-2020-19270
Malware in sbrugna...
EUVD-2020-26027
Malware in sbrugna...
EUVD-2022-28960
Malicious code in bioql PyPI...
EUVD-2024-47776
Malicious code in bioql PyPI...
EUVD-2025-18180
Malicious code in bioql PyPI...
EUVD-2024-54140
Malicious code in bioql PyPI...
EUVD-2023-46386
Malicious code in bioql PyPI...
CVE-2013-4964
Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...