CVE-2021-32742

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the Data.initbase32Encoded: function opens up the potential for exposing server memory and/or crashing the server Denial of Service for applications where untrusted data can end up in said function. Vapor does not currently...

CVE-2013-3473

The web framework in Cisco Prime Central for Hosted Collaboration Solution HCS Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600...

CVE-2025-47287

Summary: CVE-2025-47287 affects Tornado (Python Tornado) where the multipart/form-data parser can log an excessive amount of messages and continue parsing, causing a DoS due to synchronous logging. All versions prior to 6.5.0 are affected; a patch is available in Tornado 6.5.0/6.50. Affects: Torn...

CVE-2025-47287

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

CVE-2025-47287 Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

DEBIAN-CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278

CVE-2025-47278 affects Flask 3.1.0, where itsdangerous signing key handling constructs the key list in reverse, causing the last (oldest) key to be used for signing when key rotation is configured via SECRET_KEY_FALLBACKS. The result is signing sessions with stale keys, potentially hindering tran...

CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

DS-Java 安全漏洞

DS-Java is a forum system built on SSH Struts2+Spring+Hibernate by sixteen individual developers. A security vulnerability exists in DS-Java version 1.0, which stems from vulnerability to cross-site request forgery attacks...

The vulnerability of the ASP.NET Core software platform and the Microsoft Visual Studio development environment, related to authentication bypass techniques, allows attackers to escalate their privileges.

The vulnerability of the ASP.NET Core software platform and the Microsoft Visual Studio development environment is related to the ability to bypass authentication. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

Intumit SmartRobot 代码问题漏洞

Intumit SmartRobot is a web development framework from Intumit, Inc. A code issue vulnerability exists in Intumit SmartRobot that stems from vulnerability to server-side request forgery attacks...

CVE-2025-31129

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

CVE-2025-31129

Summary: CVE-2025-31129 affects the Jooby pac4j integration. In io.jooby.internal.pac4j.SessionStoreImpl#get, values are deserialized from untrusted data (notably for payloads starting with “b64~”), which can enable code execution. The issue is fixed in Jooby releases 2.17.0 (2.x stream) and 3.7....

CVE-2025-31129 jooby-pac4j: deserialization of untrusted data

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

[SECURITY] Fedora 41 Update: python-django-4.2.20-1.fc41

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 42 Update: python-django5-5.1.7-1.fc42

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Cross-site Scripting (XSS)

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper encoding of request parameters in the debug-mode error page. When the application runs with APPDEBUG=true and encounters an error, the...

The vulnerability of the org.springframework.web.multipart package in the Spring Web framework allows attackers to re-write files stored in web server directories.

The vulnerability of the org.springframework.web.multipart package in the Spring Web framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to re-upload files stored in the web server’s directory from a...

Azure Linux 3.0 Security Update: python-tensorboard / reaper (CVE-2024-43796)

The version of python-tensorboard / reaper installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43796 advisory. - Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user...