1591 matches found
CVE-2024-52804
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in th...
CVE-2024-52804
The CVE-2024-52804 issue affects Tornado prior to 6.4.2, where the HTTP cookie parsing algorithm can exhibit quadratic complexity, causing high CPU usage in the event loop and potential DoS. The documented fix is upgrading to Tornado 6.4.2. Connected advisories also reference mitigation in packag...
Sinatra security vulnerability
Sinatra is a Sinatra open source DSL for quickly creating web applications in Ruby with minimal effort A security vulnerability exists in Sinatra. An attacker exploiting this vulnerability can trigger an open redirection attack by inserting an arbitrary address in the header...
[SECURITY] Fedora 41 Update: python-fastapi-0.115.2-1.fc41
FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.8+ based on standard Python type hints. The key features are: =E2=80=A2 Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python frameworks available...
[SECURITY] Fedora 40 Update: python-fastapi-0.111.1-7.fc40
FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.8+ based on standard Python type hints. The key features are: =E2=80=A2 Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python frameworks available...
JetBrains Ktor Information Disclosure Vulnerability
JetBrains Ktor is a lightweight , asynchronous Kotlin Web framework developed by JetBrains . JetBrains Ktor suffers from an information disclosure vulnerability that stems from improper caching in the HttpCache plugin, which can be exploited by an attacker to cause the disclosure of response...
CVE-2024-48913
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...
CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...
CVE-2024-48913
Hono (web framework) before version 4.6.5 is vulnerable to CSRF protection bypass: the csrf middleware treats a request without a Content-Type header as safe, allowing an attacker to bypass CSRF protection. Impact is arthritic to user actions guarded by CSRF middleware, with reported CVSS 5.9 (Me...
CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...
Vue security vulnerabilities
Vue is an HTML, CSS, and JS framework open-sourced by Vue. It is used to develop web applications with fine-grained reactivity. A security vulnerability exists in Vue versions 2.0.0 through 3.0.0, which stems from a potential regular expression denial of service vulnerability caused by an incorre...
CVE-2024-47885
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting XSS in websites enables Astro's client-side routing and has stored attacker-controlled scriptless HTML elements i.e., iframe tag...
CVE-2024-47885
The CVE-2024-47885 entry relates to a DOM Clobbering gadget in Astro’s client-side router. Affected are Astro versions 3.0.0 through 4.16.0/4.16.1 pre-patch, where stored attacker-controlled scriptless HTML elements (e.g., iframe with unsanitized name attributes) on pages using ViewTransitions ca...
CVE-2024-47885 astro's client-side router has DOM Clobbering Gadget that leads to XSS
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting XSS in websites enables Astro's client-side routing and has stored attacker-controlled scriptless HTML elements i.e., iframe tag...
djangorestframework: Cross-site Scripting (XSS) via break_long_headers
A vulnerability was found in the djangorestframework package. Cross-site scripting occurs via the breaklongheaders template filter due to improper input sanitization before splitting and joining with tags...
Twisted Web Framework Confidential Data Access
The vulnerability of the Twisted web framework is related to the lack of security measures for website structures. Exploiting this vulnerability allows a malicious actor to gain access to confidential data and compromise its integrity...
galaxy-app (>=23.0.4, <=23.2.1), galaxy-web-apps (>=23.0.4, <=23.2.1) +1 more potentially affected by CVE-2024-42346 via galaxy-data (23.2.1)
galaxy-data PYPI version 23.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on galaxy-data and may be impacted: - galaxy-app =23.0.4, =23.0.4, =21.9.0, =23.2.1 Source cves: CVE-2024-42346 Source advisory: OSV:PYSEC-2024-273...
apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE
An improper input validation vulnerability was found in the p2c parameter in the Apache CXF JOSE. This flaw allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...
Django urlize DoS
The vulnerability of the django.utils.html.urlize function in the Django web application framework is related to inconsistencies in the parameters related to input data length. Exploiting this vulnerability could allow an attacker to cause service failures remotely...
