PYSEC-2014-77

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; semi-colon and a Content-Type that would not be accepted, as...

CVE-2014-3137

CVE-2014-3137 affects Bottle: 0.10.x prior to 0.10.12, 0.11.x prior to 0.11.7, and 0.12.x prior to 0.12.6. The issue is that the framework does not properly constrain accepted Content-Types, allowing an attacker to bypass access restrictions by sending an initial accepted Content-Type followed by...