PYSEC-2020-43

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

UBUNTU-CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

CVE-2020-25032 affects Flask-CORS (CORS Middleware for Flask) versions before 3.0.9. The issue allows directory traversal via /../ sequences because resource matching does not canonicalize pathnames, potentially exposing private files. Public sources in the connected documents confirm affected pr...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

allennlp (>=0.4.0, <=0.8.2), altair-images (>=0.1.0, <=0.1.4) +122 more potentially affected by CVE-2020-25032 via flask-cors (>=1.1.2, <=3.0.8)

flask-cors PYPI version =1.1.2, =0.4.0, =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =1.4.0, =0.1.0, =0.11.0, =0.13.0 - arcor2-arserver-data 0.11.0 and more Source cves: CVE-2020-25032 Source advisory: MEND:CVE-2020-25032...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

PT-2020-5746

Name of the Vulnerable Software and Affected Versions: Flask-CORS versions prior to 3.0.9 Description: The issue is related to incorrect path naming checks in the Flask-CORS extension for handling resource sharing between sources. This allows a remote attacker to access private resources by...

py-Flask-Cors -- directory traversal vulnerability

praetorian-colby-morgan reports: An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

vulhub

It is an offensive tool for web application security training. The target product/service or framework is not explicitly stated, but the repository contains various vulnerable environments based on Docker-Compose, including Flask, Apache, Nginx, and others. The vulnerability class/vector is not...

vulhub

It is an offensive tool for Vulnerable Environments Based on Docker-Compose. The repository contains a collection of pre-built vulnerable docker environments, allowing users to easily create and test vulnerable environments without requiring prior knowledge of Docker. The tool is designed to be...

vulhub

It is an offensive tool for web application security training. The primary target product/service or framework is not explicitly stated, but it appears to be a collection of vulnerable environments based on Docker-Compose. The vulnerability class/vector is not specified, but it likely involves we...

Sitadel

This is a web application security scanner called Sitadel, which is an update for WAScan making it compatible with Python 3.4 and above. It allows for more flexibility in writing new modules and implementing new features, such as frontend framework detection, content delivery network detection, a...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability is a Server-Side Template Injection SSTI vulnerability in a Flask application. The repository contains a Docker Compose file that sets up a vulnerable environment for testing and demonstration...

vulhub

This is an open-source collection of pre-built vulnerable docker environments, called Vulhub. It provides a simple way to create a vulnerable environment for testing and learning purposes. The project is maintained by phith0n and has a community of contributors and backers. The environments are...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The repository contains a variety of vulnerable environments, including Flask SSTI, Apache Parsing Vulnerability, and more. The environments are designed to be easy to use, with simple installation and usage instructions...

sanic-skywalking-middleware (>=1.0.0, <=1.0.1), skywalking-flask (>=0.0.3, <=0.0.6) +1 more potentially affected by CVE-2020-13921 via apache-skywalking (0.1.0)

apache-skywalking PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-skywalking and may be impacted: - sanic-skywalking-middleware =1.0.0, =0.0.3, =0.0.2, =0.0.5 Source cves: CVE-2020-13921 Source advisory: OSV:PYSEC-2020-342...

skywalking-flask (0.0.7), skywalking-sanic (0.0.6) potentially affected by CVE-2020-13921 via apache-skywalking (0.3.0)

apache-skywalking PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-skywalking and may be impacted: - skywalking-flask 0.0.7 - skywalking-sanic 0.0.6 Source cves: CVE-2020-13921 Source advisory: OSV:PYSEC-2020-342...

vulhubs

This is an open-source collection of pre-built vulnerable docker environments. It is not a PoC exploit for a specific CVE, but rather a toolkit for testing and training purposes. The repository contains various vulnerable environments, including Flask SSTI, Apache Parsing Vulnerability, and more...