NewStart CGSL CORE 5.05 / MAIN 5.05 : python Multiple Vulnerabilities (NS-SA-2020-0094)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python packages installed that are affected by multiple vulnerabilities: - http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricke...

NewStart CGSL CORE 5.04 / MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2020-0059)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities: - http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricke...

Amazon Linux 2 : python, --advisory ALAS2-2020-1432 (ALAS-2020-1432)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1432 advisory. http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain:...

Pi-hole 4.4.0 - Remote Code Execution (Authenticated)

Exploit Title: Pi-hole 4.4.0 - Remote Code Execution Authenticated Date: 2020-05-22 Exploit Author: Photubias Vendor Advisory: 1 https://github.com/pi-hole/AdminLTE Version: Pi-hole . Based and improved on: https://github.com/Frichetten/CVE-2020-11108-PoC/blob/master/cve-2020-11108-rce.py File na...

PSF-2019-14 Regular Expression Denial of Service in http.cookiejar

The regex http.cookiejar.LOOSEHTTPDATERE is vulnerable to regular expression denial of service "REDoS". LOOSEHTTPDATERE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a HTTP server. Processing a response from a malicious HTTP server can lead to extreme...

CVE-2018-20852

http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostnam...

CVE-2018-20852

CVE-2018-20852 describes a flaw in Python’s http.cookiejar DefaultPolicy.domain_return_ok where domain validation is insufficient, allowing an attacker-controlled server to siphon cookies by using a host name that has another valid hostname as a suffix (e.g., pythonicexample.com to access example...

PT-2019-20113

Name of the Vulnerable Software and Affected Versions http.cookiejar affected versions not specified Description The issue concerns the handling of cookies by the http.cookiejar module, specifically when using the DefaultCookiePolicy. Cookies set for a path, such as path=/any, are sent to...