ExtAnalysis - Browser Extension Analysis Framework

With ExtAnalysis you can : Download & Analyze Extensions From: Chrome Web Store Firefox Addons Analyze Installed Extensions of: Google Chrome Mozilla Firefox Opera Browser Coming Soon Upload and Scan Extensions. Supported formats: .crx .xpi .zip Features of ExtAnalysis : View Basic Informations:...

Flerken - Obfuscated Command Detection Tool

Command line obfuscation has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". To bypass signature-based detection, dedicated obfuscation techniques are shown to be used by red-team penetrations and even APT activities. Meanwhile,...

openSUSE Security Update : python-Flask (openSUSE-2019-1112)

This update for python-Flask to version 0.12.4 fixes the following issues : Security issue fixed : - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279 This update was import...

openSUSE: Security Advisory for python-Flask (openSUSE-SU-2019:1112-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1112-1 Security update for python-Flask

This update for python-Flask to version 0.12.4 fixes the following issues: Security issue fixed: - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279 This update was imported...

Security update for python-Flask (low)

openSUSE Security Update: Security update for python-Flask Announcement ID: openSUSE-SU-2019:1112-1 Rating: low References: 1106279 Cross-References: CVE-2018-1000656 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

SUSE-SU-2019:0657-1 Security update for python-Flask

This update for python-Flask to version 0.12.4 fixes the following issues: Security issue fixed: - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279...

50m-ctf: Writeup Hackerone 50M CTF

Writeup Hackerone 50m CTF First stage of this ctf we need to solve an hidden file from an image which posted by HackerOne at twitter https://twitter.com/hacker0x01/status/1100543680383832065?lang=en. I tried to run bunch of steganography tools and i found something with zteg the exact command is...

CVE-2019-7548

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Recent assessments: kevthehermit at April 23, 2020 8:30pm UTC reported: SQLAlchemy is one of the most popular ORMs for Python / SQL Database interaction. It is heavily used in python web applications with frameworks...

Python Flask Cookie Signer

This is a generic module which can manipulate Python Flask-based application cookies. The Retrieve action will connect to a web server, grab the cookie, and decode it. The Resign action will do the same as above, but after decoding it, it will replace the contents with that in NEWCOOKIECONTENT,...

Arbitrary Code Execution

openstack-ironic-discoverd is vulnerable to arbitrary code execution. It was discovered that enabling debug mode in openstack-ironic-discoverd also enables debug mode in the underlying Flask framework. If errors are encountered while Flask is in debug mode, a user experiencing an error may be abl...

flask-pie (>=0.0.2, <=0.1.0), negmas (>=0.1.36, <=0.2.25) +8 more potentially affected by CVE-2017-18342 via pyyaml (>=5.1.0b1, <=5.1.0b3)

pyyaml PYPI version =5.1.0b1, =0.0.2, =0.1.36, =0.2.2, =1.8.0, =0.3.8, =0.0.1, =0.0.41 - pybump 1.0.5 - pycmdparse 1.0.0 - yamldown 0.1.7 Source cves: CVE-2017-18342 Source advisory: GHSA-RPRW-H62V-C2W7...

flask-pie (>=0.0.2, <=0.1.0), negmas (>=0.1.36, <=0.2.25) +8 more potentially affected by CVE-2017-18342 via pyyaml (>=5.1.0b1, <=5.1.0b3)

pyyaml PYPI version =5.1.0b1, =0.0.2, =0.1.36, =0.2.2, =1.8.0, =0.3.8, =0.0.1, =0.0.41 - pybump 1.0.5 - pycmdparse 1.0.0 - yamldown 0.1.7 Source cves: CVE-2017-18342 Source advisory: OSV:GHSA-RPRW-H62V-C2W7...

alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)

flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: OSV:GHSA-894G-6J7Q-2HX6...

alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)

flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: GHSA-894G-6J7Q-2HX6...

Flask-Admin Cross-site Scripting vulnerability

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

GHSA-894G-6J7Q-2HX6 Flask-Admin Cross-site Scripting vulnerability

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

Flask < 0.12.3 Denial of Service Vulnerability

The version of Pallets Flask on the remote host is prior to 0.12.3. It is, therefore, affected by a denial of service vulnerability in the JSON decoding process due to improper input validation. An unauthenticated attacker can exploit this issue by providing JSON data in a non-text related...

Python Flask Installed (Linux)

Binary data pythonflaskinstallednix.nbin...

Endpoint for Out-of-Band Exfiltration: Arecibo

In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band OOB techniques in order to exfiltrate information through DNS resolutions or HTTP requests. To address this kind of situation the faster and simpler solution can be the use of a Burp...