CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

Duplicate Advisory: Incorrect Authorization in Gerapy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references. Original Description An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in projectconfigure function...

GHSA-29VR-79W7-P649 Duplicate Advisory: Incorrect Authorization in Gerapy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references. Original Description An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in projectconfigure function...

PT-2022-12183 · Gerapy · Gerapy

Name of the Vulnerable Software and Affected Versions: Gerapy version 0.9.7 Description: An Access Control issue exists in Gerapy via the spider parameter in the project configure function. Recommendations: For Gerapy version 0.9.7, consider restricting access to the project configure function...

Number withdrawal

Gerapy is a distributed crawler management framework based on Scrapy, Scrapyd, Django and Vue.js. A security vulnerability exists in Gerapy v 0.9.7, which stems from an access control vulnerability that can be caused by the spider parameter in the projectconfigure function. No details of the...

PT-2021-23983

Name of the Vulnerable Software and Affected Versions: Gerapy versions prior to 0.9.8 Description: Gerapy is a distributed crawler management framework. The issue allows for remote code execution. The project configure function is affected. Recommendations: For Gerapy versions prior to 0.9.8,...

PYSEC-2020-44

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the projectconfigure endpoint, isn’t being sanitized...

CVE-2020-7698

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the projectconfigure endpoint, isn’t being sanitized...

PT-2020-19721

Name of the Vulnerable Software and Affected Versions Gerapy versions 0 through 0.9.3 Description The issue arises from unsanitized input being passed to Popen via the "project configure" endpoint. Recommendations For Gerapy versions 0 through 0.9.3, update to version 0.9.3 or later to resolve th...

Command Injection

Overview gerapy is a Distributed Crawler Management Framework Based on Scrapy, Scrapyd, Scrapyd-Client, Scrapyd-API, Django and Vue.js. Affected versions of this package are vulnerable to Command Injection. The input being passed to Popen, via the projectconfigure endpoint, isn’t being sanitized...