requests: subsequent requests to the same host ignore cert verification

An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification...

AZL-42106 CVE-2024-35195 affecting package tensorflow for versions less than 2.16.1-8

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verif...

0lever-utils (>=0.0.2 <=0.0.7), 128autograder (>=5.0.1 <=6.0.0rc4) +10482 more potentially affected by CVE-2024-35195 via requests (>=0.13.7 <=2.31.0)

requests PYPI version =0.13.7, =0.0.2, =5.0.1, =0.0.1a0, =0.1.1001, =0.1.0, =0.0.2, =0.0.5, =0.1.0, =0.1.0, =0.1.8 and more Source cves: CVE-2024-35195 Source advisory: OSV:GHSA-9WX4-H78V-VM56...

Hewlett Packard Enterprise MSA Controller Environment Issue Vulnerability

The Hewlett Packard Enterprise MSA Controller HPE MSA Controller is a series of controllers from Hewlett Packard Enterprise USA. A security vulnerability exists in versions prior to Hewlett Packard Enterprise MSA Controller IN210R004, which stems from a vulnerability that allows an attacker to...

CVE-2023-32681 affecting package python-requests for versions less than 2.27.1-6

CVE-2023-32681 affecting package python-requests for versions less than 2.27.1-6. A patched version of the package is available...

USN-6155-2 requests vulnerability

USN-6155-1 fixed a vulnerability in Requests. This update provides the corresponding update for Ubuntu 16.04 ESM and 18.04 ESM. Original advisory details: Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly leaked Proxy-Authorization headers. A remote attacker could possibly us...

Sending batch withdrawal requests can possibly DoS

Lines of code Vulnerability details Impact The function BatchRequests.sendWithdrawalRequests allows calling the sendWithdrawalRequests function on all of the Yieldy contracts at once. However, due to the unbounded for loop, if many Yieldy contracts are added to contracts, this function can...

CVE-2022-1333 A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service...

CVE-2021-24801

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...

jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

A cross-site request forgery CSRF vulnerability was found in the config-file-provider Jenkins plugin. The plugin does not require POST requests for an HTTP endpoint which allows attackers to delete configuration files corresponding to an attacker-specified ID...

CVE-2021-22179

A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature...

CVE-2020-10076

Removed by vendor...

Requests package for Python information disclosure vulnerability

Requests package for Python is a Python-based open source HTTP library . A security vulnerability exists in Requests package for Python 2.19.1 and earlier versions released before 2018-09-14, which stems from a program that, when receiving a redirected request with the same hostname that converts...

2d6io-cryptobot (=0.0.1), aat-downloader (>=0.0.1 <=0.0.3) +889 more potentially affected by CVE-2018-18074 via requests (>=0.13.7 <=2.1.0)

requests PYPI version =0.13.7, =0.0.1, =0.2.0rc1, =1.0.2, =0.4.5, =1.0.0, =0.18.0.3, =0.70.0, =0.0.1, =0.3.3, =1.1.0rc6, =2.0.1 and more Source cves: CVE-2018-18074 Source advisory: OSV:GHSA-X84V-XCM2-53PG...

2d6io-cryptobot (=0.0.1), aat-downloader (>=0.0.1 <=0.0.3) +889 more potentially affected by CVE-2018-18074 via requests (>=0.13.7 <=2.1.0)

requests PYPI version =0.13.7, =0.0.1, =0.2.0rc1, =1.0.2, =0.4.5, =1.0.0, =0.18.0.3, =0.70.0, =0.0.1, =0.3.3, =1.1.0rc6, =2.0.1 and more Source cves: CVE-2018-18074 Source advisory: OSV:PYSEC-2018-28...

CVE-2016-6311

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

Cisco TelePresence Video Communication Server Expressway HTTP GET Request Denial of Service Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows remote users to send special HTTP GET requests for denial of service attacks...

PYSEC-2015-17

The resolveredirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect...

Ubuntu 14.04 LTS : Requests vulnerability (USN-2531-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2531-1 advisory. Matthew Daley discovered that Requests incorrectly handled cookies without host values when being redirected. A remote attacker could possibly use this issue to...

CVE-2014-1830

Requests aka python-requests before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request...