PYSEC-2020-43

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

UBUNTU-CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2020-25032

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

PT-2020-5746 · Flask +3 · Flask-Cors +3

Name of the Vulnerable Software and Affected Versions: Flask-CORS versions prior to 3.0.9 Description: The issue is related to incorrect path naming checks in the Flask-CORS extension for handling resource sharing between sources. This allows a remote attacker to access private resources by...

py-Flask-Cors -- directory traversal vulnerability

praetorian-colby-morgan reports: An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

National Insider Threat Awareness Month

September is National Insider Threat Awareness Month NIATM, which is a collaborative effort between the National Counterintelligence and Security Center NCSC, National Insider Threat Task Force NITTF, Office of the Under Secretary of Defense Intelligence and Security USDI&S, Department of Homelan...

CVE-2020-14371

A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite...

AWS Recon - Multi-threaded AWS Inventory Collection Tool With A Focus On Security-Relevant Resources And Metadata

A multi-threaded AWS inventory collection tool. The creators of this tool have a recurring need to be able to efficiently collect a large amount of AWS resource attributes and metadata to help clients understand their cloud security posture. There are a handful of tools e.g. AWS Config,...

Yelp: Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting

Summary: Hello everyone, The feature to invite users to manage your business has no rate limiting or captcha implemented. Therefore, a malicious user can use this to mail bomb any email's inbox with invitation requests. Platforms Affected: biz.yelp.com Steps To Reproduce: This is a pretty straigh...

Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54838)

WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...

Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54836)

WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...

Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54837)

WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...

The vulnerability of the BIND DNS server, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the BIND DNS server is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-53573)

WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Company Limited, which can be exploited by attackers to cause the program...

Server-Side Request Forgery (SSRF)

ftp-srv is vulnerable to server-side request forgery. A remote client is able to submit requests on behalf of the server and access resources within the internal network accessible by the server, including private resources in the hosting environment...

Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking a remote resource Image, Video or web page from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

The vulnerability of the Libvirt virtualization management library lies in the improper assignment of permissions to critical resources, allowing attackers to increase their privileges.

The vulnerability of the Libvirt virtualization management library is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...