Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
5.3CVSS
4.5AI Score
0.001EPSS
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
6.1CVSS
4.9AI Score
0.001EPSS
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
6.5CVSS
7AI Score
0.001EPSS
9.8CVSS
9.5AI Score
0.563EPSS
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
7.5CVSS
6.1AI Score
0.001EPSS
9.8CVSS
5.4AI Score
0.002EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
5.4CVSS
6AI Score
0.001EPSS
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
7.4CVSS
7.3AI Score
0.001EPSS
8.8CVSS
8.6AI Score
0.001EPSS
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET_KEY variable. This issue has been patched in version 0.5.0b3.dev77.
7.5CVSS
7.4AI Score
0.118EPSS
pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in pyload allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. Forged or otherwise, corrupted log files can be used to cover an attac...
5.3CVSS
5.4AI Score
0.005EPSS
pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attac...
9.6CVSS
8.7AI Score
0.001EPSS
pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the get_redirect_url function when redirecting users at login. This vulnerability h...
6.1CVSS
6.2AI Score
0.0005EPSS
pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.
9.1CVSS
7.4AI Score
0.0004EPSS