Lucene search

K

10 matches found

CVE
CVE
added 2024/05/06 3:15 p.m.597 views

CVE-2024-34069

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and ...

7.5CVSS6.5AI score0.00212EPSS
CVE
CVE
added 2023/10/25 6:17 p.m.378 views

CVE-2023-46136

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffe...

8CVSS7.5AI score0.0041EPSS
CVE
CVE
added 2023/02/14 8:15 p.m.335 views

CVE-2023-25577

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If...

7.5CVSS7.5AI score0.00332EPSS
CVE
CVE
added 2023/02/14 8:15 p.m.289 views

CVE-2023-23934

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain. ...

3.5CVSS5.2AI score0.00242EPSS
CVE
CVE
added 2024/10/25 8:15 p.m.232 views

CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests (e.g. all flask applications) are vulnerable to a relatively simple but effective re...

7.5CVSS7.3AI score0.00875EPSS
CVE
CVE
added 2019/07/28 1:15 p.m.229 views

CVE-2019-14322

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

7.5CVSS7.3AI score0.90059EPSS
CVE
CVE
added 2019/08/09 3:15 p.m.206 views

CVE-2019-14806

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

7.5CVSS7.3AI score0.00224EPSS
CVE
CVE
added 2022/05/25 1:15 a.m.188 views

CVE-2022-29361

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations invo...

9.8CVSS9.2AI score0.28683EPSS
CVE
CVE
added 2017/10/23 4:29 p.m.111 views

CVE-2016-10516

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

6.1CVSS5.9AI score0.00314EPSS
CVE
CVE
added 2020/11/18 3:15 p.m.99 views

CVE-2020-28724

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

6.1CVSS6.1AI score0.00923EPSS