64 matches found
CVE-2022-31517
The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
Session Fixation
Flask is vulnerable to Session Fixation. The vulnerability is due to incorrect key list construction and Flask passing the signing key first instead of last, allowing an attacker with access to an old signing key to generate valid session tokens and bypass key rotation...
CVE-2025-47278
A flaw was found in Flask. This vulnerability allows sessions to be signed with stale keys via incorrect fallback key configuration...
Exploit for Use of Persistent Cookies Containing Sensitive Information in Palletsprojects Flask
CVE-2023-30861 PoC Proof of Concept ⚠️ 주의 CAUTION...
Security Bulletin: Vulnerability in Flask affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2023-30861]
Summary The Flask package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2023-30861 Vulnerability Details CVEID:CVE-2023-30861 DESCRIPTION: Pallets Flask could allow a remote attacker to obtain sensitive information, caused by...
The vulnerability in the Flask web interface for generating queries to the Vanna database allows a hacker to write arbitrary files and execute arbitrary commands.
The vulnerability in the Flask web framework’s database query generation interface for Vanna involves unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to write any files and execute any commands by sending specially created queries...
pyload Unauthenticated Flask Configuration Leakage vulnerability
Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. PoC Run pyload in the default configuration by...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
USN-6111-1 flask vulnerability
It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive information...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Flask vulnerability (USN-6111-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6111-1 advisory. It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive...
CVE-2023-30861 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...
Flask 安全漏洞
Pallets Project Flask is a lightweight WSGI Web Server Gateway Interface application framework from the Pallets Project. A security vulnerability exists in Flask where a data response for one client may be cached and later sent by a proxy to other clients...
CVE-2022-31554
The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31509
The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
Path traversal
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
GHSA-RVF8-C35M-8289 Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...
vulhub1
It is an offensive tool for web application exploitation. The primary vulnerability targeted is a Server-Side Template Injection SSTI in Flask, as evidenced by the presence of the flask/ssti directory. The tool is likely designed to exploit this vulnerability, allowing an attacker to inject...