DEBIAN-CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-14

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

GHSA-HH7M-RX4F-4VPV CSRF can expose users authentication token

Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Patches Version 3.4.5 and soon to ...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CSRF can expose users authentication token

Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Patches Version 3.4.5 and soon to ...

CVE-2021-21241: Cross-Site Request Forgery (CSRF)

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Backdoor.Win32.Ketch.b Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: https://malvuln.com/advisory/9d7be3799594a82bf7056905f501af03.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Ketch.b Vulnerability: Remote Stack Buffer Overflow Description: Makes HTTP GET reque...

IBM Emptoris Strategic Supply Management Platform Information Disclosure Vulnerability

The IBM Emptoris Strategic Supply Management Platform is the public portal to the Emptoris suite of products. An information disclosure vulnerability exists in IBM Emptoris Strategic Supply Management Platform 10.1.0, 10.1.1, and 10.1.3. The vulnerability stems from the product transmitting...

CVE-2020-4893

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984...

PT-2021-12217

Name of the Vulnerable Software and Affected Versions IBM Emptoris Strategic Supply Management versions 10.1.0 through 10.1.3 Description The issue allows sensitive information to be transmitted in HTTP GET request parameters, potentially leading to information disclosure via man-in-the-middle...

GJSON Denial of Service Vulnerability

GJSON is a Go package that provides a fast and easy way to get values from json documents. A denial of service vulnerability exists in GJSON 1.6.5 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted GET call...

CVE-2020-36067

GJSON =v1.6.5 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a crafted GET call...

UBUNTU-CVE-2020-36067

GJSON =v1.6.5 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a crafted GET call...

Server side request forgery (ssrf)

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may le...

PT-2020-17350

Name of the Vulnerable Software and Affected Versions tindy2013 subconverter version 0.6.4 Description The issue concerns a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it. However, it does not account for the...

CVE-2020-35579: Undefined Security Weakness

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a reque...

DEBIAN-CVE-2020-35381

jsonparser 1.0.0 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a GET call...

UBUNTU-CVE-2020-35381

jsonparser 1.0.0 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a GET call...

Buger Jsonparser Security Vulnerability

Buger Jsonparser is a Go-based codebase for interacting with data in json format by Buger's individual developers. A security vulnerability exists in jsonparser 1.0.0, which can be exploited to cause a denial of service via a GET call...

Seacms 11.1 - 'file' Local File Inclusion

Exploit Title: Seacms 11.1 - 'file' Local File Inclusion Date: 20201212 Exploit Author: j5s Vendor Homepage: https://www.seacms.net/ Software Link: https://www.seacms.net/ Version: 11.1 GET /SEACMS111/5f9js3/adminsafe.php?action=download&file=C:/windows/system.ini HTTP/1.1 Host: 192.168.137.139...