PYSEC-2022-159

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

PYSEC-2022-159

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

CVE-2022-0577

CVE-2022-0577 affects Scrapy (scrapy/scrapy) prior to 2.6.1, where sensitive information could be exposed to an unauthorized actor. Public sources describe leakage related to redirections where HTTP Authorization headers and cookies may be sent to unintended domains. Several connected advisories ...

CVE-2022-0577 Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

CVE-2022-0577

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

CVE-2022-0577 Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

Scrapy 信息泄露漏洞

Scrapy is a free and open-source web crawler framework written in Python.An information disclosure vulnerability exists in versions of Scrapy prior to 2.6.1, which stems from the product's failure to effectively protect sensitive information. An attacker could use this vulnerability to obtain...

py-Scrapy -- exposure of sensitive information vulnerability

ranjit-git reports: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1...

2adif (=0.1.0), addgene-mcp (>=0.1.0 <=0.1.3) +552 more potentially affected by unknown CVE via scrapy (>=2.0.1 <=2.5.1)

scrapy PYPI version =2.0.1, =0.1.0, =0.10.0, =0.0.1, =0.4.0, =0.1.4, =1.0.0, =0.0.1, =1.0.0, =0.0.24, =2.9.3, =0.2.3, =0.3.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MFJM-VH54-3F96...

article-extract (>=0.1.2 <=0.1.3), bookscrape (>=0.0.1.dev1 <=0.0.2b7) +19 more potentially affected by unknown CVE via scrapy (>=1.3.3 <=1.8.0)

scrapy PYPI version =1.3.3, =0.1.2, =0.0.1.dev1, =1.2.1.20160901, =0.0.5, =0.0.20, =0.9.3, =0.0.1, =1.0.0, =1.0.0, =1.7.2, =1.1.0, =0.1.0, =0.2.3, =0.0.1, =0.1.5, =0.1.8 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MFJM-VH54-3F96...

Scrapy cookie-setting is not restricted based on the public suffix list

Impact Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix. Patches...

GHSA-MFJM-VH54-3F96 Scrapy cookie-setting is not restricted based on the public suffix list

Impact Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix. Patches...

article-extract (>=0.1.2 <=0.1.3), bookscrape (>=0.0.1.dev1 <=0.0.2b7) +19 more potentially affected by CVE-2022-0577 via scrapy (>=1.3.3 <=1.8.0)

scrapy PYPI version =1.3.3, =0.1.2, =0.0.1.dev1, =1.2.1.20160901, =0.0.5, =0.0.20, =0.9.3, =0.0.1, =1.0.0, =1.0.0, =1.7.2, =1.1.0, =0.1.0, =0.2.3, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2022-0577 Source advisory: OSV:GHSA-CJVR-MFJ7-J4J8...

2adif (=0.1.0), addgene-mcp (>=0.1.0 <=0.1.3) +552 more potentially affected by CVE-2022-0577 via scrapy (>=2.0.1 <=2.6.0)

scrapy PYPI version =2.0.1, =0.1.0, =0.10.0, =0.0.1, =0.4.0, =0.1.4, =1.0.0, =0.0.1, =1.0.0, =0.0.24, =2.9.3, =0.2.3, =0.3.7 and more Source cves: CVE-2022-0577 Source advisory: OSV:GHSA-CJVR-MFJ7-J4J8...

Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy

Impact If you manually define cookies on a Request object, and that Request object gets a redirect response, the new Request object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain. Patches Upgrade to Scrapy 2.6.0, which resets cookies when creati...

GHSA-CJVR-MFJ7-J4J8 Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy

Impact If you manually define cookies on a Request object, and that Request object gets a redirect response, the new Request object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain. Patches Upgrade to Scrapy 2.6.0, which resets cookies when creati...

PT-2022-13273 · Scrapy +2 · Scrapy +2

Name of the Vulnerable Software and Affected Versions: scrapy versions prior to 2.6.1 Description: The issue concerns the exposure of sensitive information to unauthorized actors. When a Request object is manually defined with cookies and receives a redirect response, the new Request object...

py-Scrapy -- cookie injection vulnerability

Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix...

Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy

BUG ====== Cookie header leaked to third party site and it allow to hijack victim account SUMMURY ============= When you crawling a site with cookie and it received Location header to redirect then scrappy send all cookie to this redirect url even if this is different domain . But every browser...

Gerapy Authentication Remote Command Execution Vulnerability

Gerapy is a crawler framework based on the Scrapy Scrapyd Scrapyd Client Scrapyd API Django. Gerapy authenticates remote command execution vulnerabilities, which can be exploited by attackers to gain control of the server...