GHSA-94MF-XFG5-R247 Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

PT-2019-11622

Name of the Vulnerable Software and Affected Versions: Invenio-App versions prior to 1.1.1 Description: A host header injection attack has been identified in Invenio-App. This issue can be exploited if the web server is configured to route all requests to the application, the APP ALLOWED HOSTS...

GHSA-X64G-WJMW-W328 Injection vulnerability that affects ironic-discoverd

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

Injection vulnerability that affects ironic-discoverd

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

Password Cracker: Webapps

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from various web applications. Atlassian uses PBKDF2-HMAC-SHA1 which is 12001 in hashcat. PHPass uses phpass which is 400 in hashcat. Mediawiki is MD5 based and is 3711 in hashcat. Apache Superset, some...

ExtAnalysis - Browser Extension Analysis Framework

With ExtAnalysis you can : Download & Analyze Extensions From: Chrome Web Store Firefox Addons Analyze Installed Extensions of: Google Chrome Mozilla Firefox Opera Browser Coming Soon Upload and Scan Extensions. Supported formats: .crx .xpi .zip Features of ExtAnalysis : View Basic Informations:...

Flerken - Obfuscated Command Detection Tool

Command line obfuscation has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". To bypass signature-based detection, dedicated obfuscation techniques are shown to be used by red-team penetrations and even APT activities. Meanwhile,...

openSUSE: Security Advisory for python-Flask (openSUSE-SU-2019:1112-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : python-Flask (openSUSE-2019-1112)

This update for python-Flask to version 0.12.4 fixes the following issues : Security issue fixed : - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279 This update was import...

OPENSUSE-SU-2019:1112-1 Security update for python-Flask

This update for python-Flask to version 0.12.4 fixes the following issues: Security issue fixed: - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279 This update was imported...

Security update for python-Flask (low)

openSUSE Security Update: Security update for python-Flask Announcement ID: openSUSE-SU-2019:1112-1 Rating: low References: 1106279 Cross-References: CVE-2018-1000656 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

SUSE-SU-2019:0657-1 Security update for python-Flask

This update for python-Flask to version 0.12.4 fixes the following issues: Security issue fixed: - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. bsc1106279...

50m-ctf: Writeup Hackerone 50M CTF

Writeup Hackerone 50m CTF First stage of this ctf we need to solve an hidden file from an image which posted by HackerOne at twitter https://twitter.com/hacker0x01/status/1100543680383832065?lang=en. I tried to run bunch of steganography tools and i found something with zteg the exact command is...

CVE-2019-7548

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Recent assessments: kevthehermit at April 23, 2020 8:30pm UTC reported: SQLAlchemy is one of the most popular ORMs for Python / SQL Database interaction. It is heavily used in python web applications with frameworks...

Python Flask Cookie Signer

This is a generic module which can manipulate Python Flask-based application cookies. The Retrieve action will connect to a web server, grab the cookie, and decode it. The Resign action will do the same as above, but after decoding it, it will replace the contents with that in NEWCOOKIECONTENT,...

Arbitrary Code Execution

openstack-ironic-discoverd is vulnerable to arbitrary code execution. It was discovered that enabling debug mode in openstack-ironic-discoverd also enables debug mode in the underlying Flask framework. If errors are encountered while Flask is in debug mode, a user experiencing an error may be abl...

flask-pie (>=0.0.2, <=0.1.0), negmas (>=0.1.36, <=0.2.25) +8 more potentially affected by CVE-2017-18342 via pyyaml (>=5.1.0b1, <=5.1.0b3)

pyyaml PYPI version =5.1.0b1, =0.0.2, =0.1.36, =0.2.2, =1.8.0, =0.3.8, =0.0.1, =0.0.41 - pybump 1.0.5 - pycmdparse 1.0.0 - yamldown 0.1.7 Source cves: CVE-2017-18342 Source advisory: OSV:GHSA-RPRW-H62V-C2W7...

flask-pie (>=0.0.2, <=0.1.0), negmas (>=0.1.36, <=0.2.25) +8 more potentially affected by CVE-2017-18342 via pyyaml (>=5.1.0b1, <=5.1.0b3)

pyyaml PYPI version =5.1.0b1, =0.0.2, =0.1.36, =0.2.2, =1.8.0, =0.3.8, =0.0.1, =0.0.41 - pybump 1.0.5 - pycmdparse 1.0.0 - yamldown 0.1.7 Source cves: CVE-2017-18342 Source advisory: GHSA-RPRW-H62V-C2W7...

GHSA-894G-6J7Q-2HX6 Flask-Admin Cross-site Scripting vulnerability

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)

flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: OSV:GHSA-894G-6J7Q-2HX6...