CVE-2024-34069

Werkzeug (the Python WSGI library) contains a debugger-only vulnerability tracked as CVE-2024-34069. The issue arises in affected Werkzeug versions where the debugger can let an attacker execute code on a developer’s machine under certain conditions: the attacker must persuade the developer to vi...

CVE-2024-34069 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

BIT-MOD_WSGI-2022-2255

A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-werkzeug) security update

An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-werkzeug) security update

An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability of the WSGI-server microprogramming software for Network Attached Storage devices NAS326 and NAS542 allows a hacker to inject commands into the basic operating system.

The vulnerability of the WSGI-server microprogramming system for Network Attached Storage devices NAS326 and NAS542 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to inject commands...

GHSA-672H-6X89-76M5 Open redirect vulnerability in Flask-Security-Too

An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if...

Open redirect vulnerability in Flask-Security-Too

An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if...

Security Bulletin: IBM Storage Fusion may be vulnerable to denial of service due to Pallets Werkzeug (CVE-2023-46136)

Summary The python library Pallets Werkzeug is used by IBM Storage Fusion's backup and restore function for WSGI utilities. A vulnerability in this library could lead to Denial of Service as described the CVE listed in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2023-4613...

The vulnerability of the WSGI-server microprogramming software for network storage devices Zyxel NAS326 and NAS542 allows a hacker to execute any command on the operating system.

The vulnerability of the WSGI-server microprogramming software for network storage devices Zyxel NAS326 and NAS542 exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute an...

CVE-2023-37928

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...

CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-37928

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...

CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

Command injection

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...

Input validation

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4474

CVE-2023-4474 affects Zyxel NAS326 and NAS542 devices. The root cause is improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute OS commands by sending a crafted URL. Affected firmwares: NAS326 up to V5.21(AAZF.14)C0 and NAS542 up to V5.21(A...

CVE-2023-37928

CVE-2023-37928 affects Zyxel NAS326 and NAS542: a post-authentication command-injection in the WSGI server could allow an authenticated attacker to execute OS commands via a crafted URL. The 3.1.9 CVE entry notes a high-severity impact (CVSS 8.8; network attack vector, require LOW privileges, no ...