26 matches found
CVE-2022-21668-Pipenv-RCE-vulnerability
CVE-2022-21668-Pipenv-RCE-vulnerability 1. Introducción En este documento se analiza en detalle la vulnerabilidad de Pipenv CVE-2022-21668. Las siguientes secciones cubren el código con el bug en el archivo pipenv/utils.py, que abre la puerta a varios ataques RCE, y también la reciente corrección...
CrazyToolBox
CrazyToolBox 目录 📢 什么是 CrazyToolBox ？ ⚙️ 运行 ⭐ 当前功能 📢 什么是 CrazyToolBox ？ CrazyToolBox 是一个与 Web3 相关的实用工具集合。这些工具可以通过 CrazyToolBox 应用程序的图形界面访问。 我们将随着开发进度不断向 CrazyToolBox 添加新工具。目前，可用的工具已在下文 当前功能 部分中描述。 ⚙️ 运行 CrazyToolBox 可以使用 pipenv 运行。首先，您需要安装 pipenv。然后在项目根目录中安装依赖并激活虚拟环境： root@kitploit: pipenv install...
IRFuzz
IRFuzz - 使用Yara规则的简单扫描器 IRFuzz 是一款用于文档归档或任何文件的简单扫描器，基于Yara规则。 安装 1. 先决条件 Linux 或 OS X Yara：使用最新的发布版源代码，编译并安装（或通过 pip install yara-python 安装） Yara规则 - 你可以从此处下载Yara规则，或导入自己的自定义规则集。 Python依赖项 依赖项通过 pipenv 管理。使用以下命令安装依赖项并激活虚拟环境： $ pipenv install $ pipenv shell 运行 IRFuzz - Watchd 运行 IRFuzz $ python -m...
EUVD-2022-0202
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-21668
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files...
Fedora 37 : pipenv (2022-8a01f4e871)
The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8a01f4e871 advisory. Automatic update for pipenv-2021.5.29-7.fc37. Changelog Thu Feb 24 2022 Tomas Orsava - 2021.5.29-7 - Fix for CVE-2022-21668 Resolves: rhbz2039830 Tenable has...
Fedora: Security Advisory for pipenv (FEDORA-2022-0d007466b3)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for pipenv (FEDORA-2022-508e460384)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for pipenv (FEDORA-2022-77ce20f03a)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
GHSA-QC9X-GJCV-465W Pipenv's requirements.txt parsing allows malicious index url in comments
Issue Summary Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file e.g. with "pipenv install -r requirements.txt...
Remote Code Execution (RCE)
pipenv is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of requirements files allowing an attacker to inject a maliciously crafted string inside a comment in a requirements.txt file...
CVE-2022-21668
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
CVE-2022-21668
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
PYSEC-2022-6
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
CVE-2022-21668
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
PYSEC-2022-6
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
Design/Logic Flaw
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
UBUNTU-CVE-2022-21668
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
CVE-2022-21668 Pipenv's requirements.txt parsing allows malicious index url in comments
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...
CVE-2022-21668 Pipenv's requirements.txt parsing allows malicious index url in comments
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims...