Withdrawn Advisory: ReDoS in py library when used with subversion

Withdrawn Advisory This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references. Original Description The py library through 1.11.0 for Python allows remote attackers to condu...

Code injection

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled...

CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

CVE-2022-42969: Inefficient Regular Expression Complexity

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

CVE-2022-42969

CVE-2022-42969 affects the Python package py (through 1.11.0). The vulnerability allows a remote ReDoS via a crafted InfoSvnCommand argument in a Subversion repository, caused by mishandling of the info data, per connected IBM security bulletin. The description notes that this issue has been disp...

PT-2022-26687

Name of the Vulnerable Software and Affected Versions py versions through 1.11.0 Description The py library allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled...

CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

CVE-2022-42731

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

CVE-2022-42731: Authentication Bypass by Capture-replay

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

Security Bulletin: IBM Security QRadar Network Threat Analytics uses component Python Py with denial of service vulnerability (CVE-2020-29651)

Summary This product includes vulnabilities that can be exploited crafting input in the UI per the CVE. The fix updates the component to address the vulnerability. Vulnerability Details CVEID:CVE-2020-29651 DESCRIPTION: Python Py is vulnerable to a denial of service, caused by a regular expressio...

exotel-py includes code execution backdoor inserted by a third party

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. Users should downgrade to version 0.1.5 to avoid the problem...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

CVE-2022-38792 : The exotel (exotel-py) package on PyPI up to version 0.1.6 includes a code execution backdoor inserted by a third party. Exploitation details are not provided in the available documents. A remediation is to downgrade to version 0.1.5. The vulnerability has a high impact score (CV...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792: Undefined Security Weakness

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-36024

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the application.commands scope without the bot scope. Currently, it appears that all public bots that use slash commands are...

PYSEC-2022-43146

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the application.commands scope without the bot scope. Currently, it appears that all public bots that use slash commands are...

Sql injection

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the application.commands scope without the bot scope. Currently, it appears that all public bots that use slash commands are...