EUVD-2019-0159

Malware in sbrugna...

EUVD-2020-0240

Malware in sbrugna...

Cross-Site Request Forgery in Webargs

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)

webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: OSV:GHSA-FJQ3-5PXW-4WJ4...

aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)

webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: GHSA-FJQ3-5PXW-4WJ4...

GHSA-FJQ3-5PXW-4WJ4 Cross-Site Request Forgery in Webargs

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

Cross-Site Request Forgery (CSRF)

webargs is vulnerable to cross-site request forgery CSRF. The Content-Type header resolves to application/json when JSON input is received. If the request body is valid JSON, the application accepts it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST reques...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

PYSEC-2020-156

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

PYSEC-2020-156

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)

webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: OSV:PYSEC-2020-156...

CVE-2020-7965

The CVE-2020-7965 entry concerns the Python Webargs project (flaskparser.py) in the 5.x line up to 5.5.2. Vulnerability detail: the code does not validate that the Content-Type header is application/json when handling JSON input; if the request body is valid JSON, it is accepted even when Content...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

aiowrpr (>=0.0.1a1, <=0.0.1a7), infiniguard-api (>=1.2.10, <=1.2.11) +5 more potentially affected by CVE-2020-7965 via webargs (>=5.1.1, <=5.5.2)

webargs PYPI version =5.1.1, =0.0.1a1, =1.2.10, =1.1.0b1, =0.3.0, =1.1.0, =0.100.3rc1, =0.1.0, =0.10.0 Source cves: CVE-2020-7965 Source advisory: MEND:CVE-2020-7965...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

PT-2020-19881

Name of the Vulnerable Software and Affected Versions Webargs versions 5.x through 5.5.2 Description The issue arises from the failure to verify the Content-Type header as application/json when receiving JSON input. This allows the software to accept valid JSON requests even if the content type i...

CVE-2020-7965: Cross-Site Request Forgery (CSRF)

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

raiden (>=0.4.0, <=0.8.0) potentially affected by CVE-2019-9710 via webargs (1.8.1)

webargs PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on webargs and may be impacted: - raiden =0.4.0, =0.8.0 Source cves: CVE-2019-9710 Source advisory: OSV:GHSA-8554-JXCW-454Q...