CVE-2021-23727: Improper Neutralization of Special Elements used in a Command

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends result stores. When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery...

Celery command injection vulnerability

celery is an open source package for distributed task queues. A command injection vulnerability exists in celery versions prior to 5.2.2, which can be exploited by an attacker to access or somehow manipulate metadata in the celery backend, triggering a stored command injection vulnerability...

PT-2021-15547 · Celery +2 · Celery +2

Name of the Vulnerable Software and Affected Versions: celery versions prior to 5.2.2 Description: The issue affects the package by default trusting messages and metadata stored in backends, which can lead to a stored command injection vulnerability when an attacker gains access to or manipulates...

django-cog (1.3.5), endi-celery (6.3.4) +3 more potentially affected by CVE-2021-23727 via celery (5.2.1)

celery PYPI version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on celery and may be impacted: - django-cog 1.3.5 - endi-celery 6.3.4 - fikkie =0.1.0, =0.19.0, =202112.0.0b9, =202112.0.0b10 Source cves: CVE-2021-23727 Source advisory:...

Stored Command Injection

Overview Affected versions of this package are vulnerable to Stored Command Injection. It by default trusts the messages and metadata stored in backends result stores. When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow...

py39-celery -- command injection vulnerability

Snyk reports: This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends result stores. When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within ...

Pollenisator - Collaborative Pentest Tool With Highly Customizable Tools

Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them. Written in python 3 Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc. Tools/scripts are separated into 4 categories : wave,...

CVE-2021-35936

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

PYSEC-2021-122

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

celery-smartbase (>=0.3.1, <=0.3.3), doccano (>=1.6.0, <=1.8.0) +5 more potentially affected by CVE-2020-17495 via django-celery-results (>=2.2.0, <=2.3.1)

django-celery-results PYPI version =2.2.0, =0.3.1, =1.6.0, =3.3.3, =1.3.4.7, =1.0.3, =3.6.0, =3.7.3 - vmcenter 1.2.0rc3 Source cves: CVE-2020-17495 Source advisory: GHSA-FVX8-V524-8579...

GHSA-FVX8-V524-8579 django-celery-results Stores Sensitive Information In Cleartext

django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database. In version 2.4.0 this is no longer the default...

django-celery-results Stores Sensitive Information In Cleartext

django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database. In version 2.4.0 this is no longer the default...

celery-smartbase (>=0.3.1, <=0.3.3), doccano (>=1.6.0, <=1.8.0) +5 more potentially affected by CVE-2020-17495 via django-celery-results (>=2.2.0, <=2.3.1)

django-celery-results PYPI version =2.2.0, =0.3.1, =1.6.0, =3.3.3, =1.3.4.7, =1.0.3, =3.6.0, =3.7.3 - vmcenter 1.2.0rc3 Source cves: CVE-2020-17495 Source advisory: OSV:GHSA-FVX8-V524-8579...

Project iKy v2.7.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Installation Clone repository git clone https://gitlab.com/kennbroorg/iKy.git Install Backend Redis You must install Redis wget...

Information Disclosure

djangoceleryresults is vulnerable to information disclosure. The vulnerability exists as it stores the results of a celery task in the database in plaintext without any sanitization...

CVE-2020-17495

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...

CVE-2020-17495

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...

DEBIAN-CVE-2020-17495

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...

PYSEC-2020-38

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...

CVE-2020-17495

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...