Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

SummaryA Server-Side Request Forgery SSRF vulnerability exists in processpictureurl in backend/openwebui/utils/oauth.py line 1338. The function fetches arbitrary URLs from OAuth picture claims without applying validateurl, allowing an attacker to force the server to make HTTP requests to internal...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

EUVD-2018-0002

Malware in sbrugna...

PT-2025-7078

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2024.1.6 Description: The issue concerns a potential man-in-the-middle attack due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

aiohttp-session creates non-expiring sessions

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

GHSA-MR4X-C4V9-X729 aiohttp-session creates non-expiring sessions

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000814 via aiohttp-session (0.8.0)

aiohttp-session PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - ws-web-aiohttp =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000814 Source advisory: OSV:GHSA-MR4X-C4V9-X729...

reliz (0.1.0.dev0) potentially affected by CVE-2018-1000814 via aiohttp-session (2.1.0)

aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000814 Source advisory: OSV:GHSA-MR4X-C4V9-X729...

reliz (0.1.0.dev0) potentially affected by CVE-2018-1000814 via aiohttp-session (2.1.0)

aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000814 Source advisory: GHSA-MR4X-C4V9-X729...

reliz (0.1.0.dev0) potentially affected by CVE-2018-1000814 via aiohttp-session (2.1.0)

aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000814 Source advisory: OSV:PYSEC-2018-35...

PYSEC-2018-35

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000814 via aiohttp-session (0.8.0)

aiohttp-session PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - ws-web-aiohttp =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000814 Source advisory: OSV:PYSEC-2018-35...

PYSEC-2018-35

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

Improper access control

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

reliz (0.1.0.dev0), ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000814 via aiohttp-session (>=0.8.0, <=2.1.0)

aiohttp-session PYPI version =0.8.0, =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000814 Source advisory: MEND:CVE-2018-1000814...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

CVE-2018-1000814: Insufficient Session Expiration

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

PT-2018-9538

Name of the Vulnerable Software and Affected Versions aio-libs aiohttp-session versions 2.6.0 and earlier Description The issue concerns a problem in EncryptedCookieStorage and NaClCookieStorage, which can lead to non-expiring sessions or infinite lifespan. This can be exploited by recreating a...