5606 matches found
CVE-2024-27306
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
UBUNTU-CVE-2024-27306
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
CVE-2024-27306 aiohttp vulnerable to XSS on index pages for static file handling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
CVE-2024-27306 aiohttp vulnerable to XSS on index pages for static file handling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
CVE-2024-27306
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
CVE-2024-27306
CVE-2024-27306 : An XSS vulnerability exists in aiohttp’s index pages for static file handling. Root cause: improper validation of input on index/static file pages. The issue is fixed in aiohttp 3.9.4. Public advisories recommend upgrading to the patched version; for those unable to upgrade, a wo...
0x20bf (0.0.1), 2keys (0.5.1) +2199 more potentially affected by CVE-2024-27306 via aiohttp (>=0.6.4, <=3.9.4rc0)
aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-27306 Source advisory: MEND:CVE-2024-27306...
CVE-2024-27306 aiohttp vulnerable to XSS on index pages for static file handling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
CVE-2024-27306
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
GHSA-7GPW-8WMC-PM8G aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Summary A XSS vulnerability exists on index pages for static file handling. Details When using web.static..., showindex=True, the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks...
muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2024-27306 via aiohttp (0.14.1)
aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
aiobotocore (>=0.4.0, <=0.4.1), async-patterns (0.2.0) +7 more potentially affected by CVE-2024-27306 via aiohttp (2.2.0)
aiohttp PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore =0.4.0, =0.1.1, =0.2.2, =0.48.0, =0.4.1b2, =0.5.2b0, =0.1.0a88, =0.1.0b10 Source cves: CVE-2024-27306 Source advisory:...
okami (0.1.5) potentially affected by CVE-2024-27306 via aiohttp (2.0.3)
aiohttp PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - okami 0.1.5 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
duniterpy (0.40.8), jenkins-epo (>=1.159.0, <=1.160.0) potentially affected by CVE-2024-27306 via aiohttp (2.0.0rc1)
aiohttp PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - duniterpy 0.40.8 - jenkins-epo =1.159.0, =1.160.0 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2024-27306 via aiohttp (2.3.9)
aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2024-27306 via aiohttp (0.16.5)
aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-27306 via aiohttp (2.0.2)
aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-27306 via aiohttp (2.2.3)
aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-27306 Source...
aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2024-27306 via aiohttp (1.1.0)
aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2024-27306 Source advisory: OSV:GHSA-7GPW-8WMC-PM8G...
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Summary A XSS vulnerability exists on index pages for static file handling. Details When using web.static..., showindex=True, the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks...