allennlp (>=0.4.0, <=0.8.2), altair-images (>=0.1.0, <=0.1.4) +119 more potentially affected by CVE-2020-25032 via flask-cors (>=3.0.0, <=3.0.8)

flask-cors PYPI version =3.0.0, =0.4.0, =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =1.4.0, =0.1.0, =0.11.0, =0.13.0 - arcor2-arserver-data 0.11.0 and more Source cves: CVE-2020-25032 Source advisory: GHSA-XC3P-FF3M-F46V...

allennlp (>=0.4.0, <=0.8.2), altair-images (>=0.1.0, <=0.1.4) +119 more potentially affected by CVE-2020-25032 via flask-cors (>=3.0.0, <=3.0.8)

flask-cors PYPI version =3.0.0, =0.4.0, =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =1.4.0, =0.1.0, =0.11.0, =0.13.0 - arcor2-arserver-data 0.11.0 and more Source cves: CVE-2020-25032 Source advisory: OSV:GHSA-XC3P-FF3M-F46V...

Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Horde Groupware Webmail 5.2.22 Cross Site Scripting

Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS Author: Alex Birnberg Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty Date: 04.14.2021 Vendor: https://www.horde.org/apps/webmail Link: https://github.com/horde/webmail/releases CVE: CVE-2021-26929 + Exploit Source:...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /tf-qrcode endpoint returns the authenticated user's two-factor authentication codes when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the two-factor authentication codes. The...

pidb (6.0.1), task-manager (>=6.0.0, <=6.3.0) potentially affected by unknown CVE via flask-security-too (>=3.3.0rc3, <=3.3.3)

flask-security-too PYPI version =3.3.0rc3, =6.0.0, =6.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FXQ4-R6MR-9X64...

pidb (6.0.1), task-manager (>=6.0.0, <=6.3.0) potentially affected by unknown CVE via flask-security-too (>=3.3.0rc3, <=3.3.3)

flask-security-too PYPI version =3.3.0rc3, =6.0.0, =6.3.0 Source cves: unknown CVE Source advisory: GHSA-FXQ4-R6MR-9X64...

Cross-Site Request Forgery

Cross-Site Request Forgery in Flask-Security-Too...

Flask-CORS Resource Division

The vulnerability of the CORS source handling mechanism for resource division involves incorrect checking of the path name. Exploiting this vulnerability could allow an attacker, operating remotely, to access confidential data...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2021-23980 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2021-23980 Source advisory: OSV:GHSA-VV2X-VRPJ-QQPQ...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2021-23980 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2021-23980 Source advisory: OSV:PYSEC-2021-865...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /login and /change endpoints return the authenticated user's authentication token when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the authentication token...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

DEBIAN-CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Design/Logic Flaw

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

PYSEC-2021-14

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

CVE-2021-21241

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

task-manager (>=6.0.0, <=6.3.0) potentially affected by CVE-2021-21241 via flask-security-too (>=3.3.0, <=3.3.3)

flask-security-too PYPI version =3.3.0, =6.0.0, =6.3.0 Source cves: CVE-2021-21241 Source advisory: OSV:PYSEC-2021-91...