70 matches found
CVE-2025-47278
A flaw was found in Flask. This vulnerability allows sessions to be signed with stale keys via incorrect fallback key configuration...
adminui2 (=1.5.6), altspell (>=0.1.0 <=0.4.0) +126 more potentially affected by CVE-2025-47278 via flask (=3.1.0)
flask PYPI version =3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - adminui2 =1.5.6 - altspell =0.1.0, =0.0.1, =0.1.0, =0.1.12, =1740736363.0.0, =1.0.0, =1.0.0, =1.0.1 - data-quality-assessment =0.1.0 -...
Exploit for Use of Persistent Cookies Containing Sensitive Information in Palletsprojects Flask
CVE-2023-30861 PoC Proof of Concept ⚠️ 주의 CAUTION...
Security Bulletin: Vulnerability in Flask affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2023-30861]
Summary The Flask package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2023-30861 Vulnerability Details CVEID:CVE-2023-30861 DESCRIPTION: Pallets Flask could allow a remote attacker to obtain sensitive information, caused by...
The vulnerability in the Flask web interface for generating queries to the Vanna database allows a hacker to write arbitrary files and execute arbitrary commands.
The vulnerability in the Flask web framework’s database query generation interface for Vanna involves unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to write any files and execute any commands by sending specially created queries...
pyload Unauthenticated Flask Configuration Leakage vulnerability
Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. PoC Run pyload in the default configuration by...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
USN-6111-1 flask vulnerability
It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive information...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Flask vulnerability (USN-6111-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6111-1 advisory. It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive...
anitya (=1.8.0), enosimulator (>=0.1.0 <=0.3.4) +4 more potentially affected by CVE-2023-30861 via flask (>=2.3.0 <=2.3.1)
flask PYPI version =2.3.0, =0.1.0, =0.2.0, =0.0.26, =0.0.1, =5.2.0.dev799, =5.2.1 Source cves: CVE-2023-30861 Source advisory: OSV:PYSEC-2023-62...
CVE-2023-30861 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...
Flask 安全漏洞
Pallets Project Flask is a lightweight WSGI Web Server Gateway Interface application framework from the Pallets Project. A security vulnerability exists in Flask where a data response for one client may be cached and later sent by a proxy to other clients...
anitya (=1.8.0), enosimulator (>=0.1.0 <=0.3.4) +4 more potentially affected by CVE-2023-30861 via flask (>=2.3.0 <=2.3.1)
flask PYPI version =2.3.0, =0.1.0, =0.2.0, =0.0.26, =0.0.1, =5.2.0.dev799, =5.2.1 Source cves: CVE-2023-30861 Source advisory: OSV:GHSA-M2QF-HXJV-5GPQ...
aaz-dev (>=1.0.2 <=2.10.1), abbr (=0.0.0) +2024 more potentially affected by CVE-2023-30861 via flask (>=0.10.1 <=2.2.4)
flask PYPI version =0.10.1, =1.0.2, =1.8.8, =0.8.44.4, =4.2.0, =1.1.4, =0.4.0, =1.5.2, =0.0.1, =0.26.0, =0.42.0 and more Source cves: CVE-2023-30861 Source advisory: OSV:GHSA-M2QF-HXJV-5GPQ...
CVE-2022-31554
The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
