CVE-2011-4212

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-1364

CVE-2011-1364 describes a CSRF vulnerability in the Google App Engine Python SDK before 1.5.4, specifically in the Interactive Console at _ah/admin/interactive/execute. The flaw allows remote attackers to hijack administrator authentication for requests that execute arbitrary Python code via the ...

CVE-2011-4211

The CVE-2011-4211 entry concerns the Google App Engine Python SDK (sandbox) prior to 1.5.4. The vulnerability arises from the FakeFile implementation not properly controlling file openings, allowing local users to bypass intended access restrictions and create arbitrary files by modifying ALLOWED...

CVE-2011-4213

The CVE-2011-4213 issue affects the Google App Engine Python SDK prior to 1.5.4, where the sandbox/Interactive Console path _ah/admin/interactive/execute is vulnerable to CSRF. The vulnerability allows remote attackers to hijack administrator authentication and execute arbitrary Python code via t...

CVE-2011-4211

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4213

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

CVE-2011-1364: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ah/admin/interactive/execute aka the Interactive Console in the SDK Console aka Admin Console in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrar...

CVE-2011-4212: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-4211: Undefined Security Weakness

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4213: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

Iframe Vulnerability in Google App Engine (Appspot)

Iframe Vulnerability in Google App Engine Appspot An Indian Hacker "Ethical Mohit " have found in Iframe Vulnerability in Contact Desk page of Google App Engine Appspot. 1 Proof of Concept :Click Here 2 Proof of Concept :Click Here Google App Engine lets you run your web applications on Google's...

Iframe Vulnerability in Google App Engine (Appspot)

Iframe Vulnerability in Google App Engine Appspot An Indian Hacker "Ethical Mohit" have found in Iframe Vulnerability in Contact Desk page of Google App Engine Appspot. 1 Proof of Concept : Click Here 2 Proof of Concept : Click Here Google App Engine lets you run your web applications on Google's...

Google ввел новую функцию по борьбе с интернет-мошенниками

Корпорация Google сегодня запустила новую функцию для своего поискового сервиса, которая позволяет активизировать борьбу с мошенническими сайтами. Функция будет полезна как обычным пользователям, так и системным администраторам, поскольку первые видят предупреждение об опасности, а вторые —...