CVE-2024-30248: Improper Neutralization of Input During Web Page Generation

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

GHSA-PMWW-V6C9-7P83 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

PT-2024-23295

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.3.2 Description The issue concerns the Piccolo Admin interface, which allows media file uploads, including SVG files by default. An attacker can upload a malicious SVG file, which, when loaded, can provide...

CVE-2024-30248

creationtimestamp| type| source ---|---|--- 2024-03-30 13:58:13+00:00| published-proof-of-concept| https://github.com/piccolo-orm/piccoloadmin/security/advisories/GHSA-pmww-v6c9-7p83...

piccolo-admin (>=0.3.1, <=0.3.2), piccolo-api (0.4.2) potentially affected by CVE-2023-47128 via piccolo (0.7.5)

piccolo PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.1, =0.3.2 - piccolo-api 0.4.2 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.3.3, <=0.3.6), piccolo-api (0.4.3) potentially affected by CVE-2023-47128 via piccolo (0.7.6)

piccolo PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.3, =0.3.6 - piccolo-api 0.4.3 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.3.8, <=0.4.0), piccolo-api (>=0.4.4, <=0.5.0) potentially affected by CVE-2023-47128 via piccolo (0.7.7)

piccolo PYPI version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.8, =0.4.4, =0.5.0 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (0.6.0), piccolo-api (>=0.7.0, <=0.7.1) potentially affected by CVE-2023-47128 via piccolo (0.10.0)

piccolo PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin 0.6.0 - piccolo-api =0.7.0, =0.7.1 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.6.1, <=0.6.2), piccolo-api (0.7.2) potentially affected by CVE-2023-47128 via piccolo (0.10.1)

piccolo PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.6.1, =0.6.2 - piccolo-api 0.7.2 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (0.6.3), piccolo-api (0.7.3) potentially affected by CVE-2023-47128 via piccolo (0.10.5)

piccolo PYPI version 0.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin 0.6.3 - piccolo-api 0.7.3 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (0.6.4), piccolo-api (0.7.4) potentially affected by CVE-2023-47128 via piccolo (0.10.7)

piccolo PYPI version 0.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin 0.6.4 - piccolo-api 0.7.4 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.9.0, <=0.9.2), piccolo-api (>=0.10.0, <=0.10.1) potentially affected by CVE-2023-47128 via piccolo (0.12.6)

piccolo PYPI version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.9.0, =0.10.0, =0.10.1 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.10.0, <=0.10.1) potentially affected by CVE-2023-47128 via piccolo (0.13.5)

piccolo PYPI version 0.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.10.0, =0.10.1 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.52.0, <=0.58.0), piccolo-api (>=0.11.0, <=0.58.0) +3 more potentially affected by CVE-2023-47128 via piccolo (0.121.0)

piccolo PYPI version 0.121.0 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.52.0, =0.11.0, =1.13.2, =1.0.0, =1.5.1 Source cves: CVE-2023-47128 Source advisory: OSV:GHSA-XQ59-7JF3-RJC6...

piccolo-admin (>=0.3.8, <=0.4.0), piccolo-api (>=0.4.4, <=0.5.0) potentially affected by CVE-2023-47128 via piccolo (0.7.7)

piccolo PYPI version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.8, =0.4.4, =0.5.0 Source cves: CVE-2023-47128 Source advisory: OSV:PYSEC-2023-241...

piccolo-admin (>=0.3.1, <=0.3.2), piccolo-api (0.4.2) potentially affected by CVE-2023-47128 via piccolo (0.7.5)

piccolo PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.1, =0.3.2 - piccolo-api 0.4.2 Source cves: CVE-2023-47128 Source advisory: OSV:PYSEC-2023-241...

piccolo-admin (>=0.3.3, <=0.3.6), piccolo-api (0.4.3) potentially affected by CVE-2023-47128 via piccolo (0.7.6)

piccolo PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.3.3, =0.3.6 - piccolo-api 0.4.3 Source cves: CVE-2023-47128 Source advisory: OSV:PYSEC-2023-241...

piccolo-admin (0.6.0), piccolo-api (>=0.7.0, <=0.7.1) potentially affected by CVE-2023-47128 via piccolo (0.10.0)

piccolo PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin 0.6.0 - piccolo-api =0.7.0, =0.7.1 Source cves: CVE-2023-47128 Source advisory: OSV:PYSEC-2023-241...

piccolo-admin (>=0.6.1, <=0.6.2), piccolo-api (0.7.2) potentially affected by CVE-2023-47128 via piccolo (0.10.1)

piccolo PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on piccolo and may be impacted: - piccolo-admin =0.6.1, =0.6.2 - piccolo-api 0.7.2 Source cves: CVE-2023-47128 Source advisory: OSV:PYSEC-2023-241...