PT-2024-28373

Name of the Vulnerable Software and Affected Versions binux pyspider versions up to 0.3.10 Description The issue is a Cross-Site Request Forgery CSRF that affects the Flask endpoints. This allows for unauthorized requests to be made on behalf of the user. Recommendations For versions up to 0.3.10...

pyspider 安全漏洞

pyspider is a powerful web crawler system open-sourced by Roy Binux. A security vulnerability exists in pyspider v0.3.10 and earlier versions, which stems from vulnerability to cross-site request forgery initiated via a Flask endpoint...

CVE-2024-39163

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

CVE-2024-39163

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

CVE-2024-39163

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

CVE-2024-39163: Cross-Site Request Forgery (CSRF)

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

CVE-2024-39163

The binux pyspider web crawler system, specifically version v0.3.10 and earlier, is vulnerable to a Cross-Site Request Forgery (CSRF) . This vulnerability exists within the Flask endpoints , allowing an attacker to manipulate the application's state. The vulnerable code is located in pyspider/web...

Fedora 41 : python-flask-cors (2024-e5558a889a)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-e5558a889a advisory. Automatic update for python-flask-cors-4.0.1-1.fc41. Changelog Mon Jun 3 2024 Frantiek Zatloukal - 4.0.1-1 - flask-cors-4.0.1 RHBZ2279177 and RHBZ2276153...

Security Bulletin: IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses third party libraries which is vulnerable to multiple CVEs

Summary IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses FlaskCors-4.0.1-py2.py3-none-any.whl, requests-2.31.0-py3-none-any.whl, express-4.19.2.tgz, commons-compress-1.22.jar, commons-io-2.11.0.jar, urllib3-1.26.18-py2.py3-none-any.whl,...

Mageia: Security Advisory (MGASA-2024-0351)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

CentOS 7 : python-flask (RHSA-2020:0870)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0870 advisory. - The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory...

CentOS 7 : python-flask (RHSA-2023:3525)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3525 advisory. - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be...

Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching

It is an offensive tool for web exploitation. This PoC exploit t...

OESA-2024-2198 python-Flask-Cors security update

A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option...

The vulnerability of Flask’s CORS storage library in Python PyPi products allows attackers to circumvent existing security restrictions.

The vulnerability of Flask’s CORS storage library in Python PyPi products is related to incorrect handling of logical operations. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely, leading to unexpected implementation of CORS policies...

Flask Weak Secret Key

Flask applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data,...

RHSA-2020:0870 Red Hat Security Advisory: python-flask security update

Bulletin has no description...

GHSA-FG5M-M723-7MV6 D-Tale Command Execution Vulnerability

D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route"/chart-data/", the query parameters from the request are directly passed into runquery for execution. And...