496 matches found
OESA-2026-1235 python-urllib3 security update
HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious...
CVE-2025-15282 Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype...
MiracleLinux 7 : python-2.7.5-93.0.1.el7.AXS7 (AXSA:2023-6068:37)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6068:37 advisory. python: urllib.parse url blocklisting bypass CVE-2023-24329 Tenable has extracted the preceding description block directly from the MiracleLinux security...
MiracleLinux 8 : python39:3.9 and python39-devel:3.9 (AXSA:2022-2905:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-2905:01 advisory. python: Information disclosure via pydoc CVE-2021-3426 python: urllib: Regular expression DoS in AbstractBasicAuthHandler CVE-2021-3733 python-lxml:...
MiracleLinux 8 : python3.11-3.11.2-2.el8.1 (AXSA:2023-6179:02)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6179:02 advisory. python: urllib.parse url blocklisting bypass CVE-2023-24329 Tenable has extracted the preceding description block directly from the MiracleLinux security...
MiracleLinux 8 : python3-3.6.8-51.el8.1.ML.1 (AXSA:2023-6176:05)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6176:05 advisory. python: urllib.parse url blocklisting bypass CVE-2023-24329 Tenable has extracted the preceding description block directly from the MiracleLinux security...
MiracleLinux 7 : python3-3.6.8-17.el7 (AXSA:2020-630:02)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-630:02 advisory. python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 python: wrong backtracking in...
PT-2026-3662
Name of the Vulnerable Software and Affected Versions Versions prior to 2025-15282 Description User-controlled data URLs parsed by urllib.request.DataHandler can allow injection of headers through newlines in the data URL mediatype. The issue involves the parsing of data URLs, potentially leading...
Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : urllib3 vulnerability (USN-7955-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7955-1 advisory. It was discovered that urllib3 incorrectly handled decompression during HTTP redirects. An attacker could possibly use thi...
Server-side Request Forgery (SSRF)
Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the io.FileIO and urllib.request.urlopen functions chaining. An attacker can access arbitrary files on the...
ROS-20251223-7324
A vulnerability in the urllib.parse.urlsplit and urlparse functions of the Python programming language interpreter is related to insufficient validation of incoming requests. Exploitation of the vulnerability could allow an attacker acting remotely to affect data integrity...
ROS-20251223-7323
A vulnerability in the urllib.parse.urlsplit and urlparse functions of the Python programming language interpreter is related to insufficient validation of incoming requests. Exploitation of the vulnerability could allow an attacker acting remotely to affect data integrity...
CVE-2025-66471 vulnerabilities
Vulnerabilities for packages: datadog-agent, dask-gateway, kserve, py3-urllib3, kubeflow-jupyter-web-app, py3-pip, open-webui, kubeflow-pipelines-visualization-server, kubeflow-pipelines, dask-kubernetes, kubeflow-volumes-web-app, semgrep, jupyter-base-notebook, az, confluent-docker-utils,...
TencentOS Server 2: unbound (TSSA-2023:0126)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0126 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
Siemens SIMATIC S7-1500 Uncontrolled Resource Consumption (CVE-2021-3733)
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client such as web browser connects to, could trigger a Regular Expression Denial of Service ReDOS during an authentication request with a specially crafted payload that is sen...
EUVD-2021-27010
Malware in sbrugna...
EUVD-2019-8136
Malware in sbrugna...
EUVD-2011-1522
Malware in sbrugna...