flask-authoob (>=0.0.21 <=0.0.34), pidb (=6.0.1) +1 more potentially affected by unknown CVE via flask-security-too (>=3.2.0rc1 <=3.3.3)

flask-security-too PYPI version =3.2.0rc1, =0.0.21, =6.0.0, =6.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FXQ4-R6MR-9X64...

Cross-Site Request Forgery

Cross-Site Request Forgery in Flask-Security-Too...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

DEBIAN-CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Design/Logic Flaw

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

pidb (=6.0.1), task-manager (>=6.0.0 <=6.3.0) potentially affected by CVE-2021-21241 via flask-security-too (>=3.3.0 <=3.3.3)

flask-security-too PYPI version =3.3.0, =6.0.0, =6.3.0 Source cves: CVE-2021-21241 Source advisory: OSV:PYSEC-2021-91...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-14

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

pidb (=6.0.1), task-manager (>=6.0.0 <=6.3.0) potentially affected by CVE-2021-21241 via flask-security-too (>=3.3.0 <=3.3.3)

flask-security-too PYPI version =3.3.0, =6.0.0, =6.3.0 Source cves: CVE-2021-21241 Source advisory: OSV:GHSA-HH7M-RX4F-4VPV...

CVE-2021-21241

The CVE-2021-21241 issue affects the Python package Flask-Security-Too (independently maintained fork of Flask-Security). In versions 3.3.0 through 3.4.4 (and including 3.4.5 before patch) the /login and /change endpoints could return the authenticated user’s token in response to a GET request. S...

CVE-2021-21241 CSRF can expose users authentication token in Flask-Security-Too

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CSRF can expose users authentication token

Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Patches Version 3.4.5 and soon to ...

PT-2021-14351 · Pypi +1 · Flask-Security-Too +1

Name of the Vulnerable Software and Affected Versions: Flask-Security-Too versions 3.3.0 through 3.4.5 Description: The issue concerns the Flask-Security-Too package, which is used to add security features to Flask applications. In affected versions, the /login and /change endpoints can return th...

pidb (=6.0.1), task-manager (>=6.0.0 <=6.3.0) potentially affected by CVE-2021-21241 via flask-security-too (>=3.3.0 <=3.3.3)

flask-security-too PYPI version =3.3.0, =6.0.0, =6.3.0 Source cves: CVE-2021-21241 Source advisory: SNYK:PYTHON-FLASKSECURITYTOO-1056906...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicio...