CVE-2021-23385

CVE-2021-23385 affects Flask-Security across all versions. The get_post_logout_redirect and get_post_login_redirect functions can bypass URL validation, allowing an open redirect to an arbitrary URL when a user supplies multiple backslashes (e.g., \evil.com/path). Exploitation requires either usi...

py-flask-security -- user redirect to arbitrary URL vulnerability

Snyk reports: This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerabilit...

USN-5532-1: Bottle vulnerability

It was discovered that Bottle incorrectly handled errors during early request binding. An attacker could possibly use this issue to disclose sensitive information. CVE-2022-31799...

CVE-2022-2255

A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...

CVE-2022-2255

A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...

PT-2022-4349 · Mod Wsgi +9 · Mod Wsgi +9

Name of the Vulnerable Software and Affected Versions: mod wsgi affected versions not specified Description: A vulnerability in mod wsgi is related to errors in processing the X-Client-IP header. This issue allows an attacker to pass the X-Client-IP header to the target WSGI application because t...

[SECURITY] Fedora 35 Update: python-bottle-0.12.21-2.fc35

Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Templates, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and template engines. All in a single file and with no dependencies other...

Debian: Security Advisory (DSA-5159-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3048-1] python-bottle security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3048-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta June 09, 2022 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

Uncaught Exception (due to a data race) leads to process termination in Waitress

Impact Waitress may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. Patches This issue has been fixed in Waitress 2.1.2 ...

CVE-2022-31015

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing t...

CVE-2022-31015

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing t...

CVE-2022-31015

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing t...

CVE-2022-31015 Uncaught Exception (due to a data race) leads to process termination in Waitress

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing t...

Django WSGI Header Spoofing Vulnerability

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

Debian: Security Advisory (DLA-3000-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3000-1] waitress security update

Debian LTS Advisory DLA-3000-1 [email protected] https://www.debian.org/lts/security/ Stefano Rivera May 12, 2022 https://wiki.debian.org/LTS Package : waitress Version : 1.0.1-1+deb9u1 CVE ID : CVE-2019-16785 CVE-2019-16786 CVE-2019-16789 CVE-2019-16792 CVE-2022-24761 Debian Bug :...

USN-5364-1: Waitress vulnerability

It was discovered that Waitress incorrectly handled certain requests. An attacker could possibly use this issue to expose sensitive information...

Waitress Environmental Issues Vulnerability (CNVD-2022-21483)

Waitress is a WSGI Web Server Gateway Interface server for Python. Waitress 2.1.0 and earlier versions are vulnerable to an environmental issue that stems from a software agent's inability to properly validate incoming HTTP requests for compliance, which allows smuggling through a front-end agent...

Mageia: Security Advisory (MGASA-2015-0026)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...