2504 matches found
aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +113 more potentially affected by CVE-2021-41265 via flask-appbuilder (>=1.10.0 <=3.3.0)
flask-appbuilder PYPI version =1.10.0, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.0, =1.10.3, =2.0.1rc2 and more Source cves: CVE-2021-41265 Source advisory: OSV:GHSA-M3RF-7M4W-R66Q...
GHSA-M3RF-7M4W-R66Q Improper Authentication in Flask-AppBuilder
Impact Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints. Patches Upgrade to...
Improper Authentication in Flask-AppBuilder
Impact Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints. Patches Upgrade to...
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
Authentication flaw
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +113 more potentially affected by CVE-2021-41265 via flask-appbuilder (>=1.10.0 <=3.3.0)
flask-appbuilder PYPI version =1.10.0, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.0, =1.10.3, =2.0.1rc2 and more Source cves: CVE-2021-41265 Source advisory: OSV:PYSEC-2021-851...
PYSEC-2021-851
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
PYSEC-2021-851
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
CVE-2021-41265
CVE-2021-41265 affects Flask-AppBuilder prior to 3.3.4, due to an improper authentication vulnerability in the REST API. The issue allows a malicious actor to authenticate with a crafted request and access protected REST API endpoints, limited to non-database authentication types and new REST API...
CVE-2021-41265 Improper Authentication in Flask-AppBuilder
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...
CVE-2021-41265
Removed by vendor...
django-cog (=1.3.5), endi-celery (=6.3.4) +3 more potentially affected by CVE-2021-23727 via celery (=5.2.1)
celery PYPI version =5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on celery and may be impacted: - django-cog =1.3.5 - endi-celery =6.3.4 - fikkie =0.1.0, =0.19.0, =202112.0.0b9, =202112.0.0b10 Source cves: CVE-2021-23727 Source advisory:...
Flask-AppBuilder 授权问题漏洞
Flask-AppBuilder is a simple and fast application development framework. An authorization issue vulnerability exists in versions of Flask-AppBuilder prior to 3.3.4 that allows a malicious actor to successfully authenticate and gain access to an existing protected REST API endpoint via a crafted...
Improper Authentication in Flask-AppBuilder
Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints...
Django: Deserialization of potentially malicious data to RCE
Hello, Django Team! It's my first time working with you, hope it will be great! Note: I have not seen this issue neither in known vulnerabilities nor in documentation, so here I am. Summary Several type of caches in https://github.com/django/django/tree/main/django/core/cache/backends use python...
GitHub Security Lab: [porcupiney.hairs]: [Python] Add Flask Path injection sinks
This bug was reported directly to GitHub Security Lab...
Cross site request forgery (csrf)
Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login via OAuth incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery...
CVE-2021-43777
Redash 10.0 and earlier are affected by CVE-2021-43777 due to improper use of the OAuth state parameter in Google Login, where the state is used to pass the next URL instead of a CSRF nonce. The issue does not affect non-Google-Login users. A patch in the master and release/10.x.x branches replac...
