48 matches found
EUVD-2019-0159
Malware in sbrugna...
EUVD-2020-0240
Malware in sbrugna...
aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)
webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: OSV:GHSA-FJQ3-5PXW-4WJ4...
GHSA-FJQ3-5PXW-4WJ4 Cross-Site Request Forgery in Webargs
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)
webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: GHSA-FJQ3-5PXW-4WJ4...
Cross-Site Request Forgery in Webargs
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
Cross-Site Request Forgery (CSRF)
webargs is vulnerable to cross-site request forgery CSRF. The Content-Type header resolves to application/json when JSON input is received. If the request body is valid JSON, the application accepts it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST reques...
CVE-2020-7965
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
CVE-2020-7965
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)
webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: OSV:PYSEC-2020-156...
PYSEC-2020-156
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
PYSEC-2020-156
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
CVE-2020-7965
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
CVE-2020-7965
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
CVE-2020-7965
The CVE-2020-7965 entry concerns the Python Webargs project (flaskparser.py) in the 5.x line up to 5.5.2. Vulnerability detail: the code does not validate that the Content-Type header is application/json when handling JSON input; if the request body is valid JSON, it is accepted even when Content...
aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)
webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: MEND:CVE-2020-7965...
CVE-2020-7965
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
CVE-2020-7965: Cross-Site Request Forgery (CSRF)
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...
PT-2020-19881
Name of the Vulnerable Software and Affected Versions Webargs versions 5.x through 5.5.2 Description The issue arises from the failure to verify the Content-Type header as application/json when receiving JSON input. This allows the software to accept valid JSON requests even if the content type i...
Webargs mishandles concurrent JSON parsing
An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests...