14 matches found
CVE-2021-41124
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
gerapy (>=0.8.5rc2, <=0.9.3), scrapy-plus (1.0.5) +2 more potentially affected by CVE-2021-41124 via scrapy-splash (0.7.2)
scrapy-splash PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy-splash and may be impacted: - gerapy =0.8.5rc2, =1.1.0, =3.2.2, =3.5.0 Source cves: CVE-2021-41124 Source advisory: GHSA-823F-CWM9-4G74...
gerapy (>=0.8.5rc2, <=0.9.3), scrapy-plus (1.0.5) +2 more potentially affected by CVE-2021-41124 via scrapy-splash (0.7.2)
scrapy-splash PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy-splash and may be impacted: - gerapy =0.8.5rc2, =1.1.0, =3.2.2, =3.5.0 Source cves: CVE-2021-41124 Source advisory: OSV:GHSA-823F-CWM9-4G74...
GHSA-823F-CWM9-4G74 Splash authentication credentials potentially leaked to target websites
Impact If you use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes robots.txt requests sent by Scrapy when the ROBOTSTXTOBEY setting is set to True. Patches Upgra...
CVE-2021-41124
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
CVE-2021-41124
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
gerapy (>=0.8.5rc2, <=0.9.3), scrapy-plus (1.0.5) +2 more potentially affected by CVE-2021-41124 via scrapy-splash (0.7.2)
scrapy-splash PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy-splash and may be impacted: - gerapy =0.8.5rc2, =1.1.0, =3.2.2, =3.5.0 Source cves: CVE-2021-41124 Source advisory: OSV:PYSEC-2021-364...
CVE-2021-41124
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
Cross site request forgery (csrf)
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
CVE-2021-41124 Splash authentication credentials potentially leaked to target websites in scrapy-splash
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
CVE-2021-41124
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...
CVE-2021-41124
The CVE affects the scrapy-splash library used with Scrapy. When HttpAuthMiddleware (http_user/http_pass) is used for Splash authentication, non-Splash requests can leak credentials to the target, including robots.txt requests if ROBOTSTXT_OBEY is True. Remediation per the reports is to upgrade t...
PT-2021-23107
Name of the Vulnerable Software and Affected Versions scrapy-splash versions prior to 0.8.0 Description The issue affects users who utilize HttpAuthMiddleware for Splash authentication, causing non-Splash requests to expose credentials to the request target. This includes robots.txt requests sent...
CVE-2021-41124: Exposure of Sensitive Information to an Unauthorized Actor
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for Splash authentication will have any non-Splash request expose your credentials to the request target. This includ...