VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing

The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

Design/Logic Flaw

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

CVE-2021-40903 affects Antminer Monitor 0.50.0 via a backdoor or misconfiguration in the Flask server settings file, where a secret string is predefined and static. This could enable improper access or governance issues due to static credentials embedded in the configuration. remediation availabl...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

PT-2022-11331 · Unknown · Antminer Monitor

Name of the Vulnerable Software and Affected Versions: Antminer Monitor version 0.50.0 Description: A vulnerability exists in the Antminer Monitor due to a backdoor or misconfiguration inside a settings file in the flask server. The settings file contains a predefined secret string that is static...

Antminer Monitor 信任管理问题漏洞

Antminer Monitor is a cryptocurrency ASIC mining hardware monitor using a simple web interface by the individual developer Anastasios Selalmazidis in Greece. A trust management issue vulnerability exists in Antminer Monitor version 0.50.0, which is caused by a backdoor or misconfiguration in the...

Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

Lin-CMS-Flask vulnerable to Improper Authentication

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...

GHSA-RVF8-C35M-8289 Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

GHSA-H6R2-PGVX-683C Lin-CMS-Flask vulnerable to Improper Authentication

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...

addok (=0.5.0), alo7-airflow (>=1.10.0 <=1.10.0.7) +185 more potentially affected by CVE-2019-14322 via werkzeug (>=0.10.1 <=0.15.4)

werkzeug PYPI version =0.10.1, =1.10.0, =1.0.17, =2.4.1, =1.10.3, =0.4.3, =0.1.0, =0.1.17, =0.6.7.post3, =0.1.0, =0.1.1, =0.6.4, =0.1.0, =0.1.0, =0.3.3 and more Source cves: CVE-2019-14322 Source advisory: OSV:GHSA-J544-7Q9P-6XP8...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

Xepor - Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

Xepor pronounced /ˈzɛfə/ , zephyr, a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP request and/or HTTP response in a human-friendly coding style. This project is meant to be used with mitmproxy. User wri...

GHSA-F9Q6-69FH-4W5W flask-oidc Open Redirect vulnerability

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

flask-oidc Open Redirect vulnerability

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect...

CVE-2022-24900 Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute...