CVE-2014-3853

CVE-2014-3853 concerns Pyplate 0.08, where the id cookie is not marked as Secure in HTTPS sessions. This can allow remote attackers to capture the cookie by intercepting its transmission in an HTTP (non-HTTPS) session, potentially enabling session-related abuse. The provided documents identify th...

CVE-2014-3852

CVE-2014-3852 affects Pyplate 0.08: the id cookie Set-Cookie header is not marked HTTPOnly, enabling potential script access to the cookie and exposure of sensitive information. The NVD reports a medium base score (5.0) with network attack vector and partial confidentiality impact. No remediation...

CVE-2014-3855

CVE-2014-3855 affects Pyplate 0.08, where download.py is vulnerable to directory traversal via a '..' in the filename parameter, allowing remote reading of arbitrary files. The vulnerability is documented with a default CVSS v2 base score of 5.0 (Medium) and a network attack vector with low acces...

CVE-2014-3855

Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-3853

Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2014-3854: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the title parameter...

PT-2014-5556

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. dot dot in the filename parameter of the download.py module. Recommendations For Pyplate version 0.08,...

PT-2014-5553

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the id cookie, as the HTTPOnly flag is not included in the Set-Cookie header. Recommendations For...

PT-2014-5552

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description The issue concerns a file permission setting in Pyplate that allows local users to access sensitive information. Specifically, the create passwd file.py script sets world-readable permissions for the passwd.db...

PT-2014-5554

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description The issue concerns a failure to set the secure flag for the id cookie in an HTTPS session. This oversight makes it easier for remote attackers to capture the cookie by intercepting its transmission within an HT...

CVE-2014-3855: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-3851: Exposure of Sensitive Information to an Unauthorized Actor

usr/lib/cgi-bin/createpasswdfile.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file...

CVE-2014-3852: Exposure of Sensitive Information to an Unauthorized Actor

Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-3853: Exposure of Sensitive Information to an Unauthorized Actor

Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2014-5555

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that conduct cross-site scripting XSS attacks. This is achieved via the title...

Pyplate - addScript.py Cross-Site Request Forgery

Pyplate - addScript.py Cross-Site Request Forgery source: https://www.securityfocus.com/bid/67610/info Pyplate is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. Pypla...

Pyplate - 'addScript.py' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/67610/info Pyplate is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. Pyplate 0.08 Beta is vulnerable; other versions may als...

[oss-security] CVE request: Pyplate multiple vulnerabilities

Hello list, My friend Teemu V. "requested" security audit for Pyplate. While quickly checking quality of this software I noticed following issues. This is not a full security audit as I don't have much free time. Tested version: v0.08 still beta Vendor notification: 2014-05-13 Issue 1. Installati...