EUVD-2020-25385

Malware in sbrugna...

EUVD-2014-1333

Malware in sbrugna...

EUVD-2021-16242

Malware in sbrugna...

EUVD-2021-0781

Malware in sbrugna...

Unity Linux 20.1060a / 20.1070a Security Update: tigervnc (UTSA-2025-986132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986132 advisory. A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which...

Double Take 代码注入漏洞

Double Take is a unified UI and API from David Jakowenko's personal developer with functionality to process and train images for facial recognition. A code injection vulnerability exists in Double Take 1.13.1 and earlier versions, which stems from improper manipulation of the X-Ingress-Path...

KLA88984 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Heap buffer overflow vulnerability in Sync an be exploited to cause denial of service. 2. Use...

CVE-2025-11360: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414484 advisory. A NULL pointer dereference flaw was found in the Linux kernels X.25 set of standardized network protocols functionality in the way a user terminates their session...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2025-644483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-644483 advisory. A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow conditi...

QNAP QuTS Hero DoS Vulnerability (QSA-25-36)

QNAP QuTS Hero is prone to a NULL pointer dereference vulnerability resulting in a denial of service DoS. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2025-984849)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984849 advisory. A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger...

Unity Linux 20.1060a / 20.1070a Security Update: tigervnc (UTSA-2025-986133)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986133 advisory. A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's reques...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414599)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414599 advisory. fs/seqfile.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bound...

Unity Linux 20.1060a / 20.1070a Security Update: tigervnc (UTSA-2025-986126)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986126 advisory. A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to...

GHSA-HM36-FFRH-C77C Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...

EUVD-2025-32539

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion...

Reliance on Untrusted Inputs in a Security Decision

Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision due to the use of X-Forwarded-For header in the cachekeyfromrequest function. An attacker...

CVE-2025-59152

Litestar vulnerability in RateLimitMiddleware: when X-Forwarded-For is present, cache_key_from_request() trusts it unconditionally, enabling per-header-bucket rate-limiting and bypass of IP-based quotas. Affected: Litestar 2.17.0 with default RateLimitMiddleware configuration. Mitigation: upgrade...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...