CVE-2022-31580

The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31572

The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31518

The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Whoogle Search Cross-site Scripting vulnerability

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in requests.py. The returned...

CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

GHSA-7488-6X3R-23W5 Ganga allows absolute path traversal

The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Ganga allows absolute path traversal

The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path Traversal

opendiamond is vulnerable to path traversal. The vulnerability exists due to a lack of sanitization of the Flask sendfile function allowing an attacker to traverse through the directory via the objpath...

Path Traversal

ganga is vulnerable to path traversal. The vulnerability exists due to a lack of sanitization of the Flask sendfile function allowing an attacker to traverse through the directory via the abspath variable...

Path Traversal

setupbox is vulnerable to path traversal. The vulnerability exists due to a lack of sanitization of the Flask sendfile function allowing an attacker to traverse through the directory via the path variable...

Path Traversal

chainerrlvisualizer is vulnerable to path traversal. The vulnerability exists due to a lack of sanitization of the Flask sendfile function allowing an attacker to traverse through the directory via the image path...

Anakin path traversal vulnerability

Anakin is a cross-platform, high-performance inference engine open-sourced by PaddlePaddle.Anakin 0.1.1 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in resource or file paths, which could be...

AutomatedQuizEval path traversal vulnerability

AutomatedQuizEval, an automated quiz evaluation system from the personal developer Sravani Boinepelli, suffers from a path traversal vulnerability that stems from the failure of Flask's sendfile function to properly filter special elements in resource or file paths, which could be exploited by...

chainerrl-visualizer路径遍历漏洞

chainerrl-visualizer is Chainer's open source way to visually analyze the behavior of ChainerRL agents to make debugging easier. chainerrl-visualizer suffers from a path traversal vulnerability that stems from a failure of the Flask sendfile function to properly filter the resource or file path f...

csm path traversal vulnerability

csm is a csm-aut open source automation and orchestration framework for IOS-XR devices. csm 3.5 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource or file path, which can be exploited by...

Fishtank path traversal vulnerability

Fishtank is a remote monitoring and control interface by Rentaro Matsukata, a personal developer in the U.S. A path traversal vulnerability exists in Fishtank 2015-06-24 and earlier versions, which stems from a failure of Flask's sendfile function to properly filter special elements in resource o...

Annotation Tool path traversal vulnerability

Annotation Tool is a Bonn activity map annotation tool open sourced by bonn-activity-maps. 2021-08-31 and earlier versions of Annotation Tool are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource o...

bt_lnmp path traversal vulnerability

btlnmp is a piaoyunsoft personal developer of a pagoda panel-based LNMP environment. btlnmp suffers from a path traversal vulnerability that stems from the failure of the Flask sendfile function to properly filter special elements in a resource or file path, which can be exploited by attackers to...

Barry-Voice-Assistant path traversal vulnerability

Barry-Voice-Assistant is a voice assistant from the Bulgarian personal developer Lyuboslav Karev. Barry-Voice-Assistant 2021-01-18 and earlier versions have a path traversal vulnerability, which stems from the failure of Flask's sendfile function to properly filter special elements in resource or...