CVE-2024-10005

CVE-2024-10005 affects Consul and Consul Enterprise. The issue arises from using URL paths in L7 traffic intentions, allowing bypass of HTTP request path-based access rules. Evidence from multiple sources (NVD entry and industry advisories) confirms the vulnerability in Consul’s URL path handling...

PT-2024-8623 · Hashicorp +4 · Hashicorp Consul +4

Name of the Vulnerable Software and Affected Versions: Consul versions 1.9.0 through 1.20.1 Description: A vulnerability was identified in Consul such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. This issue allows a remote attacker to bypass...

HashiCorp Consul 安全漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp, USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul that stems from the use of...

ROS-20241029-13

A vulnerability in the containers-common library of the Golang programming language is related to incorrect handling of certain file paths due to incorrect validation. certain file paths due to improper validation. Exploitation of the vulnerability could allow an attacker acting remotely to use...

ROS-20241029-04

A vulnerability in the containers-common library of the Golang programming language is related to incorrect handling of certain file paths due to incorrect validation. certain file paths due to improper validation. Exploitation of the vulnerability could allow an attacker acting remotely to explo...

PT-2024-38718 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240628 Description: An arbitrary file read issue exists due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute pat...

The vulnerability of the Python programming language interpreter lies in the use of an insecure search path, which allows attackers to exploit their privileges.

The vulnerability of the Python programming language interpreter is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to gain increased privileges...

UBUNTU-CVE-2024-49766

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766

A flaw was found in Werkzeug. In Python versions below v3.11 on Windows, os.path.isabs does not catch UNC paths such as //server/share. Werkzeug's safejoin relies on this check and can produce a path that is not safe, which can allow unintended access to data...

Werkzeug safe_join not safe on Windows

On Python = 3.11, or not using Windows, are not vulnerable...

Directory Traversal

Overview Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs, which allows the improper handling of UNC paths beginning with /, in the safejoin function. This allows an attacker to read some files on...

GHSA-F9VJ-2WH5-FJ8J Werkzeug safe_join not safe on Windows

On Python = 3.11, or not using Windows, are not vulnerable...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

Werkzeug 路径遍历漏洞

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A path traversal vulnerability exists in Werkzeug versions prior to 3.0.6, which stems from the inability of os.path.isabs to catch UNC paths on Windows systems with Python versions less than 3.11, resulting in...

SUSE CVE-2024-9287

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

DEBIAN-CVE-2024-9287

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

AZL-50926 CVE-2024-9287 affecting package python3 for versions less than 3.12.9-1

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...