rex-web 路径遍历漏洞

rex-web is a Rexians community website open-sourced by Rexians. A security vulnerability exists in rex-web, which stems from an insecure use of the Flask sendfile function...

opendiamond 路径遍历漏洞

opendiamond is an interactive search for non-indexed data open-sourced by cmusatyalab in the United States. A path traversal vulnerability exists in opendiamond version 10.1.1, which stems from insecure use of the Flask sendfile function...

syrabond 路径遍历漏洞

syrabond is an MQTT-based smart home system. A security vulnerability exists in syrabond version 2020-05-25 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

Python-Recipe-Database 路径遍历漏洞

Python-Recipe-Database is a recipe storage and retrieval system using Python and Mongo. A path traversal vulnerability exists in Python-Recipe-Database version 2021-03-31 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

hin-eng-preprocessing 路径遍历漏洞

hin-eng-preprocessing is an English parallel corpus of NMT by individual developers in KD, Belarus. It is used to enhance IITB Hindi. A security vulnerability exists in hin-eng-preprocessing version 2019-07-16 and earlier, which stems from an incorrect call to Flask's sendfile function resulting ...

flask-mongo-skel 路径遍历漏洞

flask-mongo-skel is a Flask MongoDB framework from Shamail Tayyab's personal developer. flask-mongo-skel 2012-11-01 and earlier versions contain a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter resource or file paths for The vulnerability is...

Stored Cross-site Scripting (XSS) leads to Account Takeover

🔒️ Requirements - Be able to edit or create documents. - Click of a user on the link. 📝 Description The markdown's link creation feature does not properly sanitize url input, which allows to use error event to execute javascript. Furthermore, due to a lack of HttpOnly flag on sessions cookie, it i...

VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing

The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

Design/Logic Flaw

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

CVE-2021-40903 affects Antminer Monitor 0.50.0 via a backdoor or misconfiguration in the Flask server settings file, where a secret string is predefined and static. This could enable improper access or governance issues due to static credentials embedded in the configuration. remediation availabl...

PT-2022-11331 · Unknown · Antminer Monitor

Name of the Vulnerable Software and Affected Versions: Antminer Monitor version 0.50.0 Description: A vulnerability exists in the Antminer Monitor due to a backdoor or misconfiguration inside a settings file in the flask server. The settings file contains a predefined secret string that is static...

Antminer Monitor 信任管理问题漏洞

Antminer Monitor is a cryptocurrency ASIC mining hardware monitor using a simple web interface by the individual developer Anastasios Selalmazidis in Greece. A trust management issue vulnerability exists in Antminer Monitor version 0.50.0, which is caused by a backdoor or misconfiguration in the...

GHSA-RVF8-C35M-8289 Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

GHSA-H6R2-PGVX-683C Lin-CMS-Flask vulnerable to Improper Authentication

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...

Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

Lin-CMS-Flask vulnerable to Improper Authentication

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...