Cross site request forgery (csrf)

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...

CVE-2021-32677

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...

CVE-2021-32677

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...

CVE-2021-32677

CVE-2021-32677 affects FastAPI

GHSA-8FXC-QM65-VPXG Temporary urls leaked via logging

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

Exploit for Unsafe Reflection in Vmware Vcenter_Server

cve-2021-21985 exploit 0x01 漏洞点 !image-20210603144442312...

CVE-2017-8761

In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

DEBIAN-CVE-2017-8761

In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

UBUNTU-CVE-2017-8761

In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

CVE-2017-8761

In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

CVE-2017-8761

OpenStack Swift CVE-2017-8761 affects proxy-server in Swift versions up to 2.14.0 (including 2.10.1, 2.11.0–2.13.0, 2.14.0). The proxy-server logs full tempurl paths, potentially exposing reusable tempurl signatures to anyone with read access to logs. All Swift deployments using the tempurl middl...

GHSA-FV82-R8QV-CH4V pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

Impact Some API endpoints under /.pomerium/ do not verify parameters with pomeriumsignature. This could allow modifying parameters intended to be trusted to Pomerium. The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass. Specific Go Packages...

Debian DSA-4918-1 : ruby-rack-cors - security update

Improper pathname handling in ruby-rack-cors, a middleware that makes Rack-based apps CORS compatible, may result in access to private resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisor...

The vulnerability of the FMW Control Plugin sub-component of the Enterprise Manager for Fusion Middleware software platform allows a malicious individual to gain access to data, modify data, or cause a partial service disruption.

The vulnerability of the FMW Control Plugin component of the Enterprise Manager for Fusion Middleware software from Oracle exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read access to data, modify data, or cause a partial service...

The vulnerability of the FMW Control Plugin sub-component of the Enterprise Manager Base Platform (EM Console) software platform of Oracle Enterprise Manager allows a attacker to cause a service failure.

The vulnerability of the FMW Control Plugin sub-component of the Enterprise Manager for Fusion Middleware software from Oracle exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures through HTTP requests...

[SECURITY] [DSA 4918-1] ruby-rack-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4918-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 18, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4918-1] ruby-rack-cors security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4918-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 18, 2021 https://www.debian.org/security/faq -...

Open Redirection

actionpack is vulnerable to open redirection. Malicious Host headers in combination with certain allowed host formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...

Possible Open Redirect Vulnerability in Action Pack

There is a possible Open Redirect Vulnerability in Action Pack. Versions Affected: = v6.1.0.rc2 Not affected: v6.1.0.rc2 Fixed Versions: 6.1.3.2 Impact ------ This is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host...

Possible Open Redirect Vulnerability in Action Pack

There is a possible Open Redirect Vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22903. Versions Affected: = v6.1.0.rc2 Not affected: v6.1.0.rc2 Fixed Versions: 6.1.3.2 Impact ------ This is similar to CVE-2021-22881: Specially crafted Host headers ...