[SECURITY] Fedora 36 Update: python-fastapi-0.75.0-3.fc36

FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.6+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python...

CVE-2022-24776

Flask-AppBuilder

CVE-2022-24711

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerabilit...

CVE-2022-24711 Remote CLI Command Execution Vulnerability in CodeIgniter4

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerabilit...

CVE-2022-24711

CVE-2022-24711 affects CodeIgniter4 before 4.1.9. An improper input validation vulnerability allows an HTTP request to trigger CLI routes. A patch is provided in 4.1.9 (upgrade to 4.1.9 or later). Other sources (GHSA, OSV, Red Hat) corroborate the remote CLI execution vector and the upgrade remed...

Rails Action Pack Information Disclosure Vulnerability (CNVD-2022-13387)

Rails Action Pack is a web framework from the US Rails community. It provides a routing mechanism mapping request URLs to actions, a controller that defines the implementation of actions and a mechanism for generating responses by rendering views templates in various formats.Rails Action Pack has...

[SECURITY] Fedora 35 Update: python-django-3.2.12-1.fc35

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora: Security Advisory for python-django (FEDORA-2022-e7fd530688)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Request logging bypass in Jenkins Audit Trail Plugin

Audit Trail Plugin logs requests whose URL path matches an admin-configured regular expression. A discrepancy between the behavior of the plugin and the Stapler web framework in parsing URL paths allows attackers to craft URLs that would bypass request logging in Audit Trail Plugin 3.6 and earlie...

PT-2022-6524 · Icinga · Icinga Web 2

Name of the Vulnerable Software and Affected Versions: Icinga Web 2 versions prior to 2.9.6 and 2.10 Description: The issue allows unauthenticated users to leak the contents of files on the local system accessible to the web-server user, including icingaweb2 configuration files with database...

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

A code execution vulnerability exists in the Stapler web framework used by Jenkins...

CVE-2022-21659

CVE-2022-21659 refers to a timing-based user enumeration vulnerability in Flask-AppBuilder (pre-3.4.4). The issue allows an unauthenticated user to infer account existence by measuring login response timing, indicating a partial confidentiality impact. Affected software is Flask-AppBuilder built ...

CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...

CVE-2022-21715

CodeIgniter4 4.x contains an XSS vulnerability in API\ResponseTrait present before 4.1.8. The issue allows cross-site scripting if a victim uses API\ResponseTrait; a patch is available in 4.1.8. Mitigations/workarounds in the sources include upgrading to 4.1.8 or later, not using API\ResponseTrai...

CVE-2022-21715 Cross-site Scripting Vulnerability in CodeIgniter4

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting XSS vulnerability was found in API\ResponseTrait in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using API\ResponseTrait. Version 4.1.8 contains a...

Crow Cross-Site Scripting Vulnerability

Crow is a C micro-framework for running Web services, and a security vulnerability exists in Crow that could be exploited to allow an attacker to manipulate input to introduce additional properties to potentially execute arbitrary code...

Crow 跨站脚本漏洞

Crow is a C micro-framework for running Web services, and a security vulnerability exists in Crow that could be exploited to allow an attacker to manipulate input to introduce additional properties to potentially execute arbitrary code...

CVE-2021-23772

A flaw was found in the Iris Web Framework, where the UploadFormFiles method unsafely handles file names during upload. This flaw allows an attacker to write in arbitrary locations outside the designated target folder...

Mozilla Rust actix-web crate memory corruption vulnerability

Rust actix-web crate is a Rust web framework. mozilla Rust actix-web crate memory corruption vulnerability can be exploited by attackers to cause memory corruption...

CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...