PYSEC-2023-173

Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not...

Code injection

Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not...

CVE-2023-41885

CVE-2023-41885 affects Piccolo ORM. The BaseUser.login implementation leaks timing information, enabling malicious users to enumerate valid usernames (time-based user enumeration). Affected: versions before 0.121.0; fixed in 0.121.0. Impact is information disclosure and potential follow-on attack...

CVE-2023-41885 Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not...

CVE-2023-41885 Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not...

Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. The current implementation of BaseUser.login leaks enough information to a malicio...

GHSA-H7CM-MRVQ-WCFR Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. The current implementation of BaseUser.login leaks enough information to a malicio...

Piccolo Security Breach

Piccolo is a fast, user-friendly ORM and query builder from Piccolo Open Source. A security vulnerability exists in Piccolo 0.120.0 and earlier versions, which stems from the presence of an information leak that can be exploited by an attacker to successfully generate a list of valid users on the...

PT-2023-28142 · Piccolo · Piccolo

Name of the Vulnerable Software and Affected Versions: Piccolo versions 0.120.0 and prior Description: The implementation of BaseUser.login in Piccolo leaks enough information to a malicious user, allowing them to generate a list of valid users on the platform. This list can be used in a password...

piccolo-mondo.co.uk Cross Site Scripting vulnerability OBB-3523798

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

piccolo-mondo.co.uk Cross Site Scripting vulnerability OBB-3384756

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...