CVE-2011-4212

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-4213

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

Design/Logic Flaw

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

Design/Logic Flaw

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

CVE-2011-4211

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

Design/Logic Flaw

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4212

CVE-2011-4212 describes a vulnerability in the Google App Engine Python SDK sandbox prior to 1.5.4. The sandbox does not properly prevent os.popen calls, allowing a local attacker with access to bypass access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._...

CVE-2011-4212

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-1364

CVE-2011-1364 describes a CSRF vulnerability in the Google App Engine Python SDK before 1.5.4, specifically in the Interactive Console at _ah/admin/interactive/execute. The flaw allows remote attackers to hijack administrator authentication for requests that execute arbitrary Python code via the ...

CVE-2011-4211

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4213

The CVE-2011-4213 issue affects the Google App Engine Python SDK prior to 1.5.4, where the sandbox/Interactive Console path _ah/admin/interactive/execute is vulnerable to CSRF. The vulnerability allows remote attackers to hijack administrator authentication and execute arbitrary Python code via t...

CVE-2011-4213

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

CVE-2011-1364: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ah/admin/interactive/execute aka the Interactive Console in the SDK Console aka Admin Console in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrar...

CVE-2011-4212: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-4211: Undefined Security Weakness

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4213: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...