Open Redirect in Flask-Security-Too

Flask-Security allows redirects after many successful views e.g. /login by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc network location as the requesting URL. This check utilizes Pythons...

werkzeug redirect vulnerability

Werkzeug is a comprehensive library for WSGI web applications. werkzeug versions prior to 0.11.6 are vulnerable to redirection. An attacker could exploit the vulnerability to redirect users to an arbitrary url via a double slash in the URL...

The vulnerability of the process_headers function (gunicorn/http/wsgi.py) in the WSGI server gunicorn, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the processheaders function gunicorn/http/wsgi.py in the WSGI server gunicorn exists due to the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to perform XSS attacks...

[SECURITY] Fedora 31 Update: python-waitress-1.4.3-1.fc31

Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.6+ and Python 3.3+. It is also known to run on PyPy 1.6.0+ on...

[SECURITY] Fedora 30 Update: python-waitress-1.4.3-1.fc30

Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.6+ and Python 3.3+. It is also known to run on PyPy 1.6.0+ on...

Debian DSA-4630-1 : python-pysaml2 - security update

It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

[SECURITY] [DSA 4630-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4630-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 21, 2020 https://www.debian.org/security/faq -...

USN-4022-1: Gunicorn vulnerability

It was discovered that gunicorn improperly handled certain input. An attacker could potentially use this issue execute a cross-site scripting XSS attack...

GHSA-926Q-WXR6-3CRQ Moderate severity vulnerability that affects roundup

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...

PYSEC-2019-201

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...

Syhunt Community Hybrid Scanner v6.2

Syhunt Community is a hybrid static and dynamic web application security scanner. Syhunt is able to scan any kind of application source code for potential security vulnerabilities, pinpointing the exact lines of the code that need to be patched. Or you can simply enter a start URL and get detaile...

USN-3666-1: Oslo middleware vulnerability

Divya K Konoor discovered Oslo middleware was vulnerable to an information disclosure. A local attacker could exploit this flaw to obtain sensitive information from OpenStack component error logs...

Gunicorn HTTP Response Splitting Vulnerability Vulnerability

gunicorn is a UNIX-based Python WSGI HTTP server software. A security vulnerability exists in the 'processheaders' function of the nicorn/http/wsgi.py file in gunicorn version 19.4.5. An attacker can exploit this vulnerability to cause the server to return arbitrary HTTP packet headers...

Debian DSA-4186-1 : gunicorn - security update

It was discovered that gunicorn, an event-based HTTP/WSGI server was susceptible to HTTP Response splitting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4186. The text itself is copyright C Software in th...

Debian: Security Advisory (DSA-4186-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 26 Update: python-werkzeug-0.12.2-1.fc26

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

[SECURITY] Fedora 27 Update: python-werkzeug-0.12.2-1.fc27

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

Ladon Framework for Python 0.9.40 - XML External Entity Expansion

Advisory: XML External Entity Expansion in Ladon Webservice Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service...

Ladon Framework For Python 0.9.40 XXE Injection

Advisory: XML External Entity Expansion in Ladon Webservice Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service...

Moderate: Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update

An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 Mitaka. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...