p5-Plack -- Multiple vulnerabilities

Plack project reports: SECURITY Fix memory leak of every request env in Plack::Middleware::Recursive CVE-2026-110333 Plack::Request::Upload-basename never returns '', '.' or '..' CVE-2026-110332 Plack::App::URLMap matches SERVERPORT literally when stripping it from Host CVE-2026-110335 BUG FIXES...

CVE-2010-2477

Multiple cross-site scripting XSS vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to 1 paste.urlparser.StaticURLParser, 2...

Fedora 11 : python-paste-1.7.4-1.fc11 (2010-10400)

1.7.4 The only real change is to paste.httpexceptions, which was using insecure quoting of some parameters and allowed an XSS hole, most specifically with its 404 messages. The most notably WSGI application using this is paste.urlparse.StaticURLParser and PkgResourcesParser. By directing someone ...