RHEL 8 : python39:3.9 and python39-devel:3.9 (RHSA-2024:5962)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5962 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 8 : python39:3.9 (RHSA-2024:7137)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:7137 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

AIX is affected by multiple vulnerabilities due to Python

IBM SECURITY ADVISORY First Issued: Tue Nov 5 15:21:42 CST 2024 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory13.asc Security Bulletin: AIX is affected by multiple vulnerabilities due to Python...

CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Summary The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: This method does not check for CRLF characters in the header valu...

CVE-2024-51329

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

CVE-2024-51329

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

CVE-2024-51329

CVE-2024-51329 – Normal details available Agile-Board 1.0 is affected by a Host header injection vulnerability that can lead to leakage of a password reset token when a user interacts with a crafted password reset link. The core issue is a Host header injection flaw, enabling an attacker to manip...

CVE-2024-51329

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

agile-board 安全漏洞

agile-board is a progressive Node.js framework by the individual developer Malik Idrees. It is used to build efficient and scalable server-side applications. A security vulnerability exists in agile-board version 1.0, which stems from a password reset token that can be obtained via Host header...

CVE-2024-51329

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

RHEL 6 / 7 : python27-python (RHSA-2016:1628)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1628 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high leve...

Refit 注入漏洞

Refit is a library in the ReactiveUI open source. Refit suffers from an injection vulnerability that stems from failing to check for CRLF characters in the header value, making it vulnerable to server-side request forgery attacks...

Express.js 安全漏洞

Express.js is a fast, unconstrained, minimalist web framework for Node.js open sourced by expressjs. A security vulnerability exists in Express.js 3.21.2 and earlier versions, which stems from a response.links function that can inject arbitrary resources in the Link header when using unaudited da...

The vulnerability of the undici.request method in the HTTP/1.1 client of the Undici software platform for Node.js allows attackers to inject arbitrary HTTP headers.

The vulnerability of the undici.request method in the Node.js software platform relates to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

Security Bulletin: IBM Observability with Instana for Self-Hosted Standard Edition is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana for Self-Hosted Standard Edition 281. Vulnerability Details CVEID:CVE-2022-41722 DESCRIPTION: Golang Go could allow a remote attacker to traverse directories on the system, caused by a flaw in the filepath.Clean...

Email header injection due to unquoted newlines

...

Moderate: Red Hat Security Advisory: python39:3.9 security update

An update for the python39:3.9 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

USN-7015-4: Python vulnerability

USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding update for CVE-2023-27043 for python2.7 and python3.5 in Ubuntu 14.04 LTS. Original advisory details: It was discovered that the Python email module incorrectly parsed email addresses that contain special...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...