Pallets Project Flask 代码问题漏洞

Pallets Project Flask is a lightweight WSGI Web Server Gateway Interface application framework from the Pallets Project. A code issue vulnerability exists in Flask version 1.10.1. The vulnerability stems from program extensions relying on Pickle for serialization, which could lead to remote code...

py-flask-caching -- remote code execution or local privilege escalation vulnerabilities

subnix reports: The Flask-Caching extension through 2.0.2 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payloa...

ag-llama-api (>=0.0.1 <=0.0.31), ag-llama-api-s (>=0.0.4 <=0.0.12) +403 more potentially affected by CVE-2020-25032 via flask-cors (>=1.1.2 <=3.0.8)

flask-cors PYPI version =1.1.2, =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =0.4.0, =0.1.0, =1.0.1, =0.14.0, =0.15.3 - amundsen-databuilder =5.1.0 and more Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

GHSA-XC3P-FF3M-F46V Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Horde Groupware Webmail 5.2.22 Cross Site Scripting

Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS Author: Alex Birnberg Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty Date: 04.14.2021 Vendor: https://www.horde.org/apps/webmail Link: https://github.com/horde/webmail/releases CVE: CVE-2021-26929 + Exploit Source:...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /tf-qrcode endpoint returns the authenticated user's two-factor authentication codes when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the two-factor authentication codes. The...

flask-authoob (>=0.0.21 <=0.0.34), pidb (=6.0.1) +1 more potentially affected by unknown CVE via flask-security-too (>=3.2.0rc1 <=3.3.3)

flask-security-too PYPI version =3.2.0rc1, =0.0.21, =6.0.0, =6.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FXQ4-R6MR-9X64...

Cross-Site Request Forgery

Cross-Site Request Forgery in Flask-Security-Too...

The vulnerability of the supplement for handling resource division between Flask-CORS sources relates to the lack of mechanisms for controlling initialized resources. This allows attackers to gain access to confidential data.

The vulnerability of the CORS source handling mechanism for resource division involves incorrect checking of the path name. Exploiting this vulnerability could allow an attacker, operating remotely, to access confidential data...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /login and /change endpoints return the authenticated user's authentication token when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the authentication token...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

DEBIAN-CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Design/Logic Flaw

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

pidb (=6.0.1), task-manager (>=6.0.0 <=6.3.0) potentially affected by CVE-2021-21241 via flask-security-too (>=3.3.0 <=3.3.3)

flask-security-too PYPI version =3.3.0, =6.0.0, =6.3.0 Source cves: CVE-2021-21241 Source advisory: OSV:PYSEC-2021-91...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-14

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...