10670 matches found
DEBIAN-CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
PYSEC-2020-43
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
Directory traversal
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
PYSEC-2020-43
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
UBUNTU-CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2020-25032
An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
PT-2020-5746 · Flask +3 · Flask-Cors +3
Name of the Vulnerable Software and Affected Versions: Flask-CORS versions prior to 3.0.9 Description: The issue is related to incorrect path naming checks in the Flask-CORS extension for handling resource sharing between sources. This allows a remote attacker to access private resources by...
National Insider Threat Awareness Month
September is National Insider Threat Awareness Month NIATM, which is a collaborative effort between the National Counterintelligence and Security Center NCSC, National Insider Threat Task Force NITTF, Office of the Under Secretary of Defense Intelligence and Security USDI&S, Department of Homelan...
py-Flask-Cors -- directory traversal vulnerability
praetorian-colby-morgan reports: An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2020-14371
A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite...
AWS Recon - Multi-threaded AWS Inventory Collection Tool With A Focus On Security-Relevant Resources And Metadata
A multi-threaded AWS inventory collection tool. The creators of this tool have a recurring need to be able to efficiently collect a large amount of AWS resource attributes and metadata to help clients understand their cloud security posture. There are a handful of tools e.g. AWS Config,...
Yelp: Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting
Summary: Hello everyone, The feature to invite users to manage your business has no rate limiting or captcha implemented. Therefore, a malicious user can use this to mail bomb any email's inbox with invitation requests. Platforms Affected: biz.yelp.com Steps To Reproduce: This is a pretty straigh...
Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54838)
WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...
Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54837)
WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...
Memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-54836)
WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Campus Edition of Zhuhai Kingsoft Office Software Limited, which can be exploited by attackers to cause a denial of service...
The vulnerability of the BIND DNS server, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the BIND DNS server is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...
Memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-53573)
WPS Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Company Limited, which can be exploited by attackers to cause the program...