SUSE CVE-2019-10906

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

Pallets Werkzeug 输入验证错误漏洞

Pallets Werkzeug is a WSGI web application library. A security vulnerability exists in Pallets Werkzeug versions prior to 2.2.3, which stems from the possibility that browsers may allow "nameless" cookies that look like "=value" instead of "key=value". "no-name" cookies that look like "=value"...

Pallets Werkzeug 安全漏洞

Pallets Werkzeug is a WSGI web application library. A security vulnerability exists in Pallets Werkzeug versions prior to 2.2.3, which stems from the fact that the Werkzeug multipart form data parser can parse an unlimited number of files, byte sections, but each section requires CPU time to pars...

The vulnerability of the Pallets Werkzeug web application library, related to deficiencies in HTTP request processing, allows attackers to execute XSS attacks.

The vulnerability of the Pallets Werkzeug web application lies in its lack of proper HTTP request processing. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted HTTP requests...

Security Bulletin: Vulnerability in Pallets Werkzeug may affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2022-29361)

Summary HTTP request smuggling vulnerability in Pallets Werkzeug can affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore. Vulnerability Details CVEID:CVE-2022-29361 DESCRIPTION: Pallets Werkzeug is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP...

CVE-2022-29361

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations...

Design/Logic Flaw

DISPUTED Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported...

Pallets Werkzeug 环境问题漏洞

Pallets Werkzeug is a WSGI web application library. An environmental issue vulnerability exists in Pallets Werkzeug version 2.1.0 and prior versions that stems from incorrectly parsing HTTP requests. An attacker could use this vulnerability to perform HTTP request smuggling via a specially crafte...

CVE-2022-29361

Removed by vendor...

CVE-2022-29361

CVE-2022-29361 affects Pallets Werkzeug ≤ 2.1.0 and enables HTTP request smuggling through improper parsing of HTTP requests. Connected sources corroborate the issue, noting potential for web cache poisoning, WAF bypass, and XSS via crafted requests, with vendor guidance that the behavior occurs ...

CVE-2022-29361

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations...

Pallets Werkzeug vulnerable to Path Traversal

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names such as C: in Windows pathnames...

GHSA-J544-7Q9P-6XP8 Pallets Werkzeug vulnerable to Path Traversal

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names such as C: in Windows pathnames...

Pallets Werkzeug cross-site scripting vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

GHSA-H2FP-XGX6-XH6F Pallets Werkzeug cross-site scripting vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

PT-2022-5090 · Pallets +1 · Werkzeug +1

Name of the Vulnerable Software and Affected Versions: Pallets Werkzeug versions 2.1.0 and below Description: The issue is related to improper parsing of HTTP requests, which can allow an attacker to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included insid...

EulerOS 2.0 SP5 : python-werkzeug (EulerOS-SA-2021-2671)

According to the versions of the python-werkzeug package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11...

EulerOS 2.0 SP3 : python-werkzeug (EulerOS-SA-2021-2612)

According to the versions of the python-werkzeug package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11...

Huawei EulerOS: Security Advisory for python-jinja2 (EulerOS-SA-2021-2430)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Pallets Werkzeug 0.15.4 - Path Traversal Exploit

Exploit Title: Pallets Werkzeug 0.15.4 - Path Traversal Original Author: Emre ÖVÜNÇ Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://palletsprojects.com/ Software Link: https://github.com/pallets/werkzeug Version: Prior to 0.15.5 Tested on: Windows Server CVE:...