Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
185 results · page 2 of 4
Sep 4, 2024Flask-AppBuilder is an application development framework.CVE-2024-45314 · Other software · dpgaspar · reported by GitHubLow 3.6
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default.CVE-2024-6221 · Other software · corydolphin · reported by security@huntr.devHigh 7.5
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.CVE-2024-32484 · Other software · Ankitects · reported by talos-cna@cisco.comHigh 7.4
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.
- Product
- Anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 28, 2024Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs.CVE-2024-5827 · Other software · vanna-ai · reported by security@huntr.devCritical 9.8
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.
- Product
- vanna-ai/vanna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug.CVE-2024-1681 · Other software · corydolphin · reported by security@huntr.devMedium 5.3
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2024-27083 · Other software · dpgaspar · reported by GitHubMedium 4.3
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2024-25128 · Other software · dpgaspar · reported by GitHubCritical 9.1
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024flaskBlog is a simple blog app built with Flask.CVE-2024-22414 · Other software · DogukanUrker · reported by GitHubMedium 6.5
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made by a user: `<div class="content" tag="content">{{comment[2]|safe}}</div>`. Use of the "safe" tag causes flask to _not_ escape the rendered content. To remediate this, simply remove the `|safe` tag from the HTML above. No fix is is available and users are advised to manually edit their installation.
- Product
- flaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An issue was discovered in the flaskcode package through 0.0.8 for Python.CVE-2023-52289 · Other software · Sujeetkv · reported by MITREHigh 7.5
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/<file_path> URI (from views.py), allows attackers to write to arbitrary files.
- Product
- Flaskcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An issue was discovered in the flaskcode package through 0.0.8 for Python.CVE-2023-52288 · Other software · Sujeetkv · reported by MITREHigh 7.5
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/<file_path>.txt URI (from views.py), allows attackers to read arbitrary files.
- Product
- Flaskcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a craftedCVE-2023-49438 · Other software · Flask-security-too Project · reported by MITREMedium 6.1
An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.
- Product
- Flask-security-too
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures.CVE-2023-46134 · Other software · man-group · reported by GitHubMedium 6.1
D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.
- Product
- dtale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2023-34110 · Other software · dpgaspar · reported by GitHubLow 2.7
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023Flask is a lightweight WSGI web application framework.CVE-2023-30861 · Other software · pallets · reported by GitHubHigh 7.5
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
- Product
- flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials.CVE-2023-29005 · Other software · dpgaspar · reported by GitHubHigh 7.5
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflask-limiter.readthedocs.iogithub.com
Aug 2, 2022This affects all versions of package Flask-Security.CVE-2021-23385 · Other software · Flask-security Project · reported by report@snyk.ioMedium 5.4
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.
- Product
- Flask-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 1, 2022Flask-AppBuilder is an application development framework built on top of Flask python framework.CVE-2022-31177 · Other software · dpgaspar · reported by GitHubLow 2.7
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31588 · Other software · Testplatform Project · reported by MITRECritical 9.3
The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Testplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31587 · Other software · Kg-fashion-chatbot Project · reported by MITRECritical 9.3
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Kg-fashion-chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31586 · Other software · Changepop-back Project · reported by MITRECritical 9.3
The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Changepop-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31585 · Other software · Home Internet Project · reported by MITRECritical 9.3
The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Home Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31584 · Other software · S3label Project · reported by MITRECritical 9.3
The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- S3label
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31583 · Other software · Automatedquizeval Project · reported by MITRECritical 9.3
The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Automatedquizeval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31582 · Other software · Videoserver Project · reported by MITRECritical 9.3
The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Videoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31581 · Other software · Scorelab · reported by MITRECritical 9.3
The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Openmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31580 · Other software · Caretakerr-api Project · reported by MITRECritical 9.3
The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Caretakerr-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31579 · Other software · Iasset Project · reported by MITRECritical 9.3
The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Iasset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31578 · Other software · BT Lnmp Project · reported by MITREHigh 7.5
The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- BT Lnmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31577 · Other software · Audio Aligner App Project · reported by MITRECritical 9.3
The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Audio Aligner App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31576 · Other software · Shackerpanel Project · reported by MITRECritical 9.3
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Shackerpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31575 · Other software · Livro Python Project · reported by MITRECritical 9.3
The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Livro Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31574 · Other software · Realestate Project · reported by MITRECritical 9.3
The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Realestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31573 · Other software · Chainer · reported by MITRECritical 9.3
The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Chainerrl-visualizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31572 · Other software · Cockybook Project · reported by MITRECritical 9.3
The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Cockybook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsCVE-2022-31571 · Other software · Python-flask-restful-api Project · reported by MITRECritical 9.3
The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python-flask-restful-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafCVE-2022-31570 · Other software · Ceneo-web-scrapper Project · reported by MITRECritical 9.8
The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Ceneo-web-scrapper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31568 · Other software · Rexians · reported by MITRECritical 9.3
The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Rex-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31567 · Other software · Data Stream Algorithm Benchmark Project · reported by MITRECritical 9.3
The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Data Stream Algorithm Benchmark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31566 · Other software · Data Stream Algorithm Benchmark Project · reported by MITREHigh 8.6
The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Data Stream Algorithm Benchmark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31565 · Other software · Syrabond Project · reported by MITRECritical 9.3
The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Syrabond
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31564 · Other software · Munhak · reported by MITRECritical 9.3
The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Munhak-moa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31563 · Other software · Vprj Project · reported by MITRECritical 9.3
The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Vprj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31562 · Other software · Internshipsystem Project · reported by MITRECritical 9.3
The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Internshipsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelCVE-2022-31561 · Other software · Sphere Imagebackend Project · reported by MITRECritical 9.3
The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Sphere Imagebackend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31560 · Other software · Photo TAG Project · reported by MITRECritical 9.3
The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Photo TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31559 · Other software · Flask-yeoman Project · reported by MITRECritical 9.3
The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Flask-yeoman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31558 · Other software · Shiva-server Project · reported by MITRECritical 9.3
The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Shiva-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31557 · Other software · Golem Project · reported by MITRECritical 9.3
The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Golem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31556 · Other software · Trainenergyserver Project · reported by MITRECritical 9.3
The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Trainenergyserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31555 · Other software · Nurse Quest Project · reported by MITRECritical 9.3
The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Nurse Quest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.