UBUNTU-CVE-2021-23385

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2021-23385 Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2021-23385

CVE-2021-23385 affects Flask-Security across all versions. The get_post_logout_redirect and get_post_login_redirect functions can bypass URL validation, allowing an open redirect to an arbitrary URL when a user supplies multiple backslashes (e.g., \evil.com/path). Exploitation requires either usi...

CVE-2021-23385

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2021-23385

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

PT-2022-9396

Name of the Vulnerable Software and Affected Versions Flask-Security versions all Description This issue allows an attacker to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes. The vulnerability is only exploitable if an alternative WSGI server othe...

py-flask-security -- user redirect to arbitrary URL vulnerability

Snyk reports: This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerabilit...

CVE-2022-31177

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

PYSEC-2022-247

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

acryl-datahub-airflow-plugin (>=0.8.44.4 <=0.9.2.1rc2), aglow (>=0.1.0rc3 <=0.1.0rc4) +130 more potentially affected by CVE-2022-31177 via flask-appbuilder (>=1.10.0 <=4.1.2)

flask-appbuilder PYPI version =1.10.0, =0.8.44.4, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.0.3, =0.0.6, =0.0.1, =0.0.3 and more Source cves: CVE-2022-31177 Source advisory: OSV:PYSEC-2022-247...

PYSEC-2022-247

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

CVE-2022-31177 affects Flask-AppBuilder versions prior to 4.1.3. An authenticated Admin could query other users by their salted and hashed password strings using partial hashed password strings. The server would not return full hashes, but an attacker could infer partial password hashes and their...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

Removed by vendor...

Information Disclosure

Flask-AppBuilder is vulnerable to information disclosure. The vulnerability exists due to the HTTP response indicating the hashed passwords insecurely, allowing attackers to infer the partial password hashes through the malicious query strings...

Flask-AppBuilder 安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.1.3, which stems from an authenticated administrator user being able to query other users via their salted and hashed password strings...

acryl-datahub-airflow-plugin (>=0.8.44.4 <=0.9.2.1rc2), aglow (>=0.1.0rc3 <=0.1.0rc4) +130 more potentially affected by CVE-2022-31177 via flask-appbuilder (>=1.10.0 <=4.1.2)

flask-appbuilder PYPI version =1.10.0, =0.8.44.4, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.0.3, =0.0.6, =0.0.1, =0.0.3 and more Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...