PT-2021-28361

Name of the Vulnerable Software and Affected Versions: Flask-Caching versions through 1.10.1 Description: The issue allows for remote code execution or local privilege escalation due to the reliance on Pickle for serialization. An attacker who gains access to cache storage, such as filesystem,...

py-flask-caching -- remote code execution or local privilege escalation vulnerabilities

subnix reports: The Flask-Caching extension through 2.0.2 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage e.g., filesystem, Memcached, Redis, etc., they can construct a crafted payloa...

feather (>=0.0.6, <=0.0.8) potentially affected by CVE-2020-25032 via flask-cors (1.1.2)

flask-cors PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - feather =0.0.6, =0.0.8 Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

wikilabels (>=0.3.1, <=0.4.0) potentially affected by CVE-2020-25032 via flask-cors (2.1.3)

flask-cors PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - wikilabels =0.3.1, =0.4.0 Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

allennlp (>=0.4.0, <=0.8.2), altair-images (>=0.1.0, <=0.1.4) +119 more potentially affected by CVE-2020-25032 via flask-cors (>=3.0.0, <=3.0.8)

flask-cors PYPI version =3.0.0, =0.4.0, =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =1.4.0, =0.1.0, =0.11.0, =0.13.0 - arcor2-arserver-data 0.11.0 and more Source cves: CVE-2020-25032 Source advisory: GHSA-XC3P-FF3M-F46V...

allennlp (>=0.4.0, <=0.8.2), altair-images (>=0.1.0, <=0.1.4) +119 more potentially affected by CVE-2020-25032 via flask-cors (>=3.0.0, <=3.0.8)

flask-cors PYPI version =3.0.0, =0.4.0, =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =1.4.0, =0.1.0, =0.11.0, =0.13.0 - arcor2-arserver-data 0.11.0 and more Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

GHSA-XC3P-FF3M-F46V Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Horde Groupware Webmail 5.2.22 Cross Site Scripting

Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS Author: Alex Birnberg Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty Date: 04.14.2021 Vendor: https://www.horde.org/apps/webmail Link: https://github.com/horde/webmail/releases CVE: CVE-2021-26929 + Exploit Source:...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /tf-qrcode endpoint returns the authenticated user's two-factor authentication codes when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the two-factor authentication codes. The...

Cross-Site Request Forgery

Cross-Site Request Forgery in Flask-Security-Too...

Flask-CORS Resource Division

The vulnerability of the CORS source handling mechanism for resource division involves incorrect checking of the path name. Exploiting this vulnerability could allow an attacker, operating remotely, to access confidential data...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2021-23980 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2021-23980 Source advisory: OSV:GHSA-VV2X-VRPJ-QQPQ...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2021-23980 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2021-23980 Source advisory: OSV:PYSEC-2021-865...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /login and /change endpoints return the authenticated user's authentication token when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the authentication token...

DEBIAN-CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Design/Logic Flaw

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...