Aspen: Server Path Disclosure

Hi Sir, I m Mahesh, Individual websecurity Researcher. i found server path disclosure in flask.io http://flask.aspen.io/en/latest/ http://flask.aspen.io/en/latest/index.html i found another path disclosure in django.io http://django.aspen.io/en/latest/ http://django.aspen.io/en/latest/index.html...

Trend Micro Deep Discovery Director Multiple Vulnerabilities

1. Advisory Information Title: Trend Micro Deep Discovery Director Multiple Vulnerabilities Advisory ID: CORE-2017-0005 Advisory URL:https://www.coresecurity.com/core-labs/advisories/trend-micro-deep-discovery-director-multiple-vulnerabilities Date published: 2017-07-12 Date of last update:...

Directory Traversal

Flask and Werkzeug are vulnerable to directory traversal attacks. These attacks are possible because it uses the safejoin method. In Windows, safejoin doesn't correctly filter file paths allowing directory traversal and disclosure of arbitrary files from a server...

gdbgui - A browser-based frontend/gui for GDB

A modern, browser-based frontend to gdb gnu debugger. Add breakpoints, view stack traces, and more in C, C++, Go, and Rust! Simply run gdbgui from the terminal and a new tab will open in your browser. Install sudo pip install gdbgui --upgrade Since gdbgui is under active development, consider...

Interactive Multi User Javascript Shell: JSShell

Interactive Multi User Javascript Shell An interactive multi-user web based shell written in Python with Flask for server side and of course Javascript and HTML client side. It was initially created in order to debug remote esoteric browsers during tests and research. Features Multi client suppor...

Browser-based GDB frontend: gdbGUI

A modern, browser-based frontend to gdb gnu debugger. Add breakpoints, view stack traces, and more in C, C++, Go, and Rust! Simply run gdbgui from the terminal and a new tab will open in your browse Features Debug a different program in each tab new gdb instance is spawned for each tab Set/remove...

[SECURITY] Fedora 25 Update: python-peewee-2.8.5-2.fc25

A small, expressive ORM written in python with built-in support for sqlite, mysql and postgresql and special extensions like hstore. For flask integration, including an admin interface and RESTful API, check out flask-peewee...

[SECURITY] Fedora 24 Update: python-peewee-2.8.5-2.fc24

A small, expressive ORM written in python with built-in support for sqlite, mysql and postgresql and special extensions like hstore. For flask integration, including an admin interface and RESTful API, check out flask-peewee...

WMD (Weapon of Mass Destruction) - Python framework for IT security tools

This is a python tool with a collection of IT security software. The software is incapsulated in "modules". The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command "use modulecall", e.g. "use apsniff", to activate the module. ...

Cross-Site Scripting (XSS)

flask-admin is vulnerable to cross-site scripting XSS attacks. This is because it does not escape html in columneditablelist values...

flask-oidc open redirect vulnerability

flask-oidc is a library for supporting OpenID connections to flask. An open redirection vulnerability exists in flask-oidc 0.1.2 and earlier versions, which can be exploited by an attacker to redirect a user to an arbitrary website and execute a phishing attack...

Open redirect

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

CVE-2016-1000001

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

PYSEC-2016-25

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

PYSEC-2016-25

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

CVE-2016-1000001

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

CVE-2016-1000001

The CVE-2016-1000001 entry concerns the flask-oidc library, where versions 0.1.2 and earlier are vulnerable to an open redirect. The vulnerability enables a misused redirect to an arbitrary URL, potentially facilitating phishing or credential-stealing scenarios for users who interact with a craft...

CVE-2016-1000001

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

Exploit for HTTP Response Splitting in Python

CVE-2016-5699-poc PoC code of CVE-2016-...

Uber: uber.com may RCE by Flask Jinja2 Template Injection

Hi, Uber Security Team I found an RCE in rider.uber.com. First, if you change your profile name to '7'7 , and you will receive a mail "Your Uber account information has been updated" sent by [email protected] And in mail body, you can see your name become '7777777' This is a vulnerability about...