PatrOwl - Open Source, Free And Scalable Security Operations Orchestration Platform

PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations scans, searches, API calls, ..., aggregating the results, relaying alerts on...

finder (>=1.0.0, <=1.0.2), flask-apikit (>=0.0.4, <=0.0.6) +5 more potentially affected by CVE-2018-17175 via marshmallow (>=3.0.0a1, <=3.0.0b8)

marshmallow PYPI version =3.0.0a1, =1.0.0, =0.0.4, =0.1.0, =0.0.1, =0.2.37, =0.2.4.3, =0.1.4, =0.1.21 Source cves: CVE-2018-17175 Source advisory: GHSA-9Q2P-FJ49-VPXJ...

burp-ui (>=0.5.0, <=0.5.1), chakraversiontracker (>=1.2.1.20160901, <=1.2.1.20160917) +36 more potentially affected by CVE-2018-1000808 via pyopenssl (>=17.0.0, <=17.4.0)

pyopenssl PYPI version =17.0.0, =0.5.0, =1.2.1.20160901, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.3.12, =0.2.0, =1.3.13, =2.2.0, =1.15.0, =1.15.0, =1.15.0, =1.15.0, =1.27.0 and more Source cves: CVE-2018-1000808 Source advisory: OSV:GHSA-2RCM-PHC9-3945...

finder (>=1.0.0, <=1.0.2), flask-apikit (>=0.0.4, <=0.0.6) +5 more potentially affected by CVE-2018-17175 via marshmallow (>=3.0.0a1, <=3.0.0b8)

marshmallow PYPI version =3.0.0a1, =1.0.0, =0.0.4, =0.1.0, =0.0.1, =0.2.37, =0.2.4.3, =0.1.4, =0.1.21 Source cves: CVE-2018-17175 Source advisory: OSV:PYSEC-2018-67...

Cross-site Scripting (XSS)

flask-admin is vulnerable to cross-site scripting XSS attacks. The library does not properly handle whitespace, allowing a malicious user to inject and execute arbitrary Javascript by using the %20 character in a url...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)

flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: OSV:PYSEC-2018-54...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

Cross site scripting

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

CVE-2018-16516 affects Flask-Admin up to version 1.5.2, where helpers.py is vulnerable to reflected XSS via a crafted URL. The root cause is improper escaping that allows attacker-supplied input to be reflected in the response. Exploitation details are not provided in the documents beyond this de...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)

flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: MEND:CVE-2018-16516...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516: Improper Neutralization of Input During Web Page Generation

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PT-2018-13605

Name of the Vulnerable Software and Affected Versions Flask-Admin version 1.5.2 Description The issue is related to Reflected XSS, which can be triggered via a crafted URL. This allows an attacker to inject malicious code into a user's browser. Recommendations For Flask-Admin version 1.5.2, updat...

CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

abbr (0.0.0), add-dependencies (2.3.0) +113 more potentially affected by CVE-2018-1000656 via flask (>=0.5.0, <=0.12.2)

flask PYPI version =0.5.0, =0.26.0, =1.4.15, =0.11.1, =0.4.0, =0.1.0, =0.1.1, =0.1.17, =0.1.0, =0.4.1, =0.1.0, =0.0.1, =0.0.2 and more Source cves: CVE-2018-1000656 Source advisory: OSV:GHSA-562C-5R94-XH97...