finder (>=1.0.0, <=1.0.2), flask-apikit (>=0.0.4, <=0.0.6) +5 more potentially affected by CVE-2018-17175 via marshmallow (>=3.0.0a1, <=3.0.0b8)

marshmallow PYPI version =3.0.0a1, =1.0.0, =0.0.4, =0.1.0, =0.0.1, =0.2.37, =0.2.4.3, =0.1.4, =0.1.21 Source cves: CVE-2018-17175 Source advisory: GHSA-9Q2P-FJ49-VPXJ...

finder (>=1.0.0, <=1.0.2), flask-apikit (>=0.0.4, <=0.0.6) +5 more potentially affected by CVE-2018-17175 via marshmallow (>=3.0.0a1, <=3.0.0b8)

marshmallow PYPI version =3.0.0a1, =1.0.0, =0.0.4, =0.1.0, =0.0.1, =0.2.37, =0.2.4.3, =0.1.4, =0.1.21 Source cves: CVE-2018-17175 Source advisory: OSV:PYSEC-2018-67...

Cross-site Scripting (XSS)

flask-admin is vulnerable to cross-site scripting XSS attacks. The library does not properly handle whitespace, allowing a malicious user to inject and execute arbitrary Javascript by using the %20 character in a url...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

Cross site scripting

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

CVE-2018-16516 affects Flask-Admin up to version 1.5.2, where helpers.py is vulnerable to reflected XSS via a crafted URL. The root cause is improper escaping that allows attacker-supplied input to be reflected in the response. Exploitation details are not provided in the documents beyond this de...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516: Improper Neutralization of Input During Web Page Generation

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PT-2018-13605

Name of the Vulnerable Software and Affected Versions Flask-Admin version 1.5.2 Description The issue is related to Reflected XSS, which can be triggered via a crafted URL. This allows an attacker to inject malicious code into a user's browser. Recommendations For Flask-Admin version 1.5.2, updat...

CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

GHSA-562C-5R94-XH97 Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

abbr (0.0.0), add-dependencies (2.3.0) +113 more potentially affected by CVE-2018-1000656 via flask (>=0.5.0, <=0.12.2)

flask PYPI version =0.5.0, =0.26.0, =1.4.15, =0.11.1, =0.4.0, =0.1.0, =0.1.1, =0.1.17, =0.1.0, =0.4.1, =0.1.0, =0.0.1, =0.0.2 and more Source cves: CVE-2018-1000656 Source advisory: GHSA-562C-5R94-XH97...

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

Denial Of Service (DoS)

Flask is vulnerable to denial of service DoS attacks. The library does not properly handle JSON files not encoded in UTF-8, leading to excessive memory being consumed, crashing the application...

CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...