Lucene search

K
DpgasparFlask-appbuilder

11 matches found

CVE
CVE
added 2025/03/03 4:15 p.m.284 views

CVE-2025-24023

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

5.3CVSS4.1AI score0.00052EPSS
CVE
CVE
added 2025/05/16 2:15 p.m.151 views

CVE-2025-32962

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FAB_SAFE_REDIRECT_HOSTS confi...

6.1CVSS4.7AI score0.00054EPSS
CVE
CVE
added 2024/02/29 1:44 a.m.137 views

CVE-2024-27083

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malici...

6.1CVSS4.3AI score0.00629EPSS
CVE
CVE
added 2023/04/10 9:15 p.m.129 views

CVE-2023-29005

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and setting an AUTH_RATE_LIMIT.

7.5CVSS7.4AI score0.00247EPSS
CVE
CVE
added 2022/08/01 7:15 p.m.120 views

CVE-2022-31177

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The res...

2.7CVSS3.1AI score0.00361EPSS
CVE
CVE
added 2022/03/24 8:15 p.m.101 views

CVE-2022-24776

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known worka...

6.1CVSS6.1AI score0.00347EPSS
CVE
CVE
added 2022/01/31 9:15 p.m.93 views

CVE-2022-21659

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server wh...

5.3CVSS5AI score0.00261EPSS
CVE
CVE
added 2021/09/08 6:15 p.m.75 views

CVE-2021-32805

Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site...

7.2CVSS6.2AI score0.00189EPSS
CVE
CVE
added 2021/06/07 7:15 p.m.69 views

CVE-2021-29621

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder

5.3CVSS5.2AI score0.0029EPSS
CVE
CVE
added 2021/12/09 5:15 p.m.61 views

CVE-2021-41265

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST...

8.8CVSS8.5AI score0.00328EPSS
CVE
CVE
added 2025/09/11 6:15 p.m.18 views

CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. T...

6.5CVSS6.8AI score0.00054EPSS