PT-2022-20780

Name of the Vulnerable Software and Affected Versions sergeKashkin/Simple-RAT versions prior to 2022-05-03 Description The issue allows for absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For versions prior to 2022-05-03, update the repository to a...

PT-2022-20850

Name of the Vulnerable Software and Affected Versions audio aligner app versions through 2020-01-10 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. This enables potential access to sensitive files outside the intended directory...

CarceresBE 路径遍历漏洞

CarceresBE is an SKS parking management system backend open sourced by Delor4. CarceresBE 1.0 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource or file path, which could be exploited by...

flask-mvc 路径遍历漏洞

flask-mvc is a repository by the individual developer Candra Nur Ihsan. A security vulnerability exists in flask-mvc version 2020-09-14 and earlier versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

PT-2022-20857

Name of the Vulnerable Software and Affected Versions sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. This enables potential access to sensitive files outside the intended...

PT-2022-20836

Name of the Vulnerable Software and Affected Versions whmacmac/vprj repository through 2022-04-06 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For versions through 2022-04-06, consider restricting access to the send fi...

CVE-2022-31515: Improper Limitation of a Pathname to a Restricted Directory

The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31512: Improper Limitation of a Pathname to a Restricted Directory

The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31510: Improper Limitation of a Pathname to a Restricted Directory

The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31505: Improper Limitation of a Pathname to a Restricted Directory

The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31503: Improper Limitation of a Pathname to a Restricted Directory

The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31511: Improper Limitation of a Pathname to a Restricted Directory

The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31507: Improper Limitation of a Pathname to a Restricted Directory

The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31502: Improper Limitation of a Pathname to a Restricted Directory

The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31501: Improper Limitation of a Pathname to a Restricted Directory

The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

mdweb 路径遍历漏洞

mdweb is a Mandoku web server from mandoku open source. A security vulnerability exists in mdweb version 2015-05-07 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

PT-2022-20781

Name of the Vulnerable Software and Affected Versions AFDudley/equanimity versions prior to 2014-04-23 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For versions prior to 2014-04-23, consider restricting access to the...

audio_aligner_app 路径遍历漏洞

audioalignerapp is a kaldi-based text alignment Web application open sourced by LongmaoTeamTf. audioalignerapp 2020-01-10 and earlier versions contain a path traversal vulnerability that stems from Flask's sendfile function failing to properly filter resources or file path, which can be exploited...

chainerrl-visualizer 路径遍历漏洞

chainerrl-visualizer is Chainer's open source way to visually analyze the behavior of ChainerRL agents to make debugging easier. chainerrl-visualizer suffers from a path traversal vulnerability that stems from a failure of the Flask sendfile function to properly filter the resource or file path f...

logstash-management-api 路径遍历漏洞

logstash-management-api is a management system interface repository by Lukas Chripko, an individual developer in Sweden. A security vulnerability exists in logstash-management-api version 2020-05-04 and earlier, which stems from an incorrect call to Flask's sendfile function that results in...