CVE-2013-2624

Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL request...

CVE-2019-16792

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two...

Design/Logic Flaw

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two...

Waitress Environmental Vulnerabilities (CNVD-2020-01314)

Waitress is a WSGI Web Server Gateway Interface server for Python. An environmental issue vulnerability exists in Waitress 1.3.1 and earlier versions. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided...

DEBIAN-CVE-2019-16785

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end serve...

CVE-2019-16785

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end serve...

PYSEC-2019-67

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

Design/Logic Flaw

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

CVE-2019-4244

IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518...

GHSA-7XXV-WPXJ-MX5V typed-ast Out-of-bounds Read

typedast 1.3.0 and 1.3.1 has an astforarguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that pars...

GHSA-M3JW-62M7-JJCM typed-ast Out-of-bounds Read

typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that...

typed_ast buffer overflow vulnerability

typedast is a Python parser. A buffer overflow vulnerability exists in typedast versions 1.3.0 and 1.3.1. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and write operations being...

CVE-2019-4216

IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187...

PT-2019-11852 · Puppet +1 · Jenkins Puppet Enterprise Pipeline +1

Name of the Vulnerable Software and Affected Versions: Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier Description: The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Securit...

GHSA-3J5X-7CCF-PPGM Cross-site scripting in recommender-xblock

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource...

CVE-2019-6534

The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file...

Design/Logic Flaw

An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/isoserver/isoserver.c, as demonstrated by examples/serverexamplegoose/serverexamplegoose.c and examples/serverexample6140025/serverexample6140025.c...

PT-2019-18283 · Unknown +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libIEC61850 version 1.3.1 Description: The issue is related to a use-after-free in the getState function, located in the file mms/iso server/iso server.c. This is demonstrated by examples in server example goose.c and server example 61400 25....

modulemd uses an unsafe function for processing externally provided data

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution...

libIEC61850 Buffer Overflow Vulnerability (CNVD-2019-43853)

libIEC61850 is an open source library for IEC 61850. A security vulnerability exists in the 'EthernetsetProtocolFilter' function in the hal/ethernet/linux/ethernetlinux.c file in libIEC61850 version 1.3.1. An attacker could exploit this vulnerability to cause a segment error...