CVE-2020-29651

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

PYSEC-2020-92

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

CVE-2020-29651

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

PYSEC-2020-92

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

CVE-2020-29651

CVE-2020-29651 affects the Python-py (py) package, specifically the py.path.svnwc component, where a denial-of-service can be triggered by crafted input to blame due to a regular-expression vulnerability. The IBM/X-Force entry lists a high/severe risk (base 7.5) and notes the issue stems from a c...

CVE-2020-29651

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

py-matrix-synapse -- DoS on Federation API

Matrix developers reports: A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /sendjoin, /sendleave, /invite or /exchangethirdpartyinvite request. This can lead to a denial of service in which future events will...

Reference counting error in `From<Py<T>>`

A bug in From would lead to an extra reference count decrement, often leading to use-after-free issues...

RUSTSEC-2020-0074 Reference counting error in `From<Py<T>>`

A bug in From would lead to an extra reference count decrement, often leading to use-after-free issues...

appian-locust (>=0.0.2 <=1.7.0), exact-sync (>=0.0.39 <=0.0.40) +2 more potentially affected by CVE-2020-28364 via locust (>=1.0.0 <=1.1.0)

locust PYPI version =1.0.0, =0.0.2, =0.0.39, =0.0.29, =0.4.0, =0.5.0 Source cves: CVE-2020-28364 Source advisory: OSV:PYSEC-2020-60...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

Awesome-Red-Teaming

This is a list of resources for Red Teaming, a list that will be updated regularly with the latest adversarial tactics and techniques based on the Mitre ATT&CK framework. The list covers various topics such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credenti...

FreeBSD : py-matrix-synapse -- XSS vulnerability (5f39d80f-107c-11eb-8b47-641c67a117d8)

Matrix developers reports : The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities,...

py-matrix-synapse -- XSS vulnerability

Matrix developers reports: The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities,...

FreeBSD : py-matrix-synapse -- malformed events may prevent users from joining federated rooms (2327234d-fc4b-11ea-adef-641c67a117d8)

Affected Synapse versions assume that all events have an 'origin' field set. If an event without the 'origin' field is sent into a federated room, servers not already joined to the room will be unable to do so due to failing to fetch the malformed event. Impact : An attacker could cause a denial ...

PT-2020-17233 · Python +4 · Py +4

Name of the Vulnerable Software and Affected Versions: py versions through 1.9.0 Description: A denial of service via regular expression in the py.path.svnwc component could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame...

py-Flask-Cors -- directory traversal vulnerability

praetorian-colby-morgan reports: An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

FreeBSD : security/py-ecdsa -- multiple issues (a23ebf36-e8b6-4665-b0f3-4c977f9a145c)

py-ecdsa developers report : Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding. Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Code injection

An unhandled exception in checkignored in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.1...

Fedora 32 : python37 (2020-87c0a0a52d)

Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possib...