AI

Certifi removes GLOBALTRUST root certificate

Werkzeug safe_join() allows Windows special device names

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

urllib3 does not control redirects in browsers and Node.js

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow has a heap buffer overflow with nested list coordinates

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Flask session does not add `Vary: Cookie` header when accessed in some ways

pytest has vulnerable tmpdir handling

Flask-CORS improper regex path matching vulnerability

flask-cors vulnerable to log injection when the log level is set to debug

Werkzeug safe_join() allows Windows special device names with compound extensions

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Flask-CORS allows for inconsistent CORS matching

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

setuptools vulnerable to Command Injection via package URL

Werkzeug safe_join not safe on Windows

tqdm CLI arguments injection attack

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

Jinja has a sandbox breakout through malicious filenames

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Werkzeug safe_join() allows Windows special device names

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Jinja has a sandbox breakout through indirect reference to format method

Werkzeug possible resource exhaustion when parsing file data in forms

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

h11 accepts some malformed Chunked-Encoding bodies

FITS GZIP decompression bomb in Pillow

Pillow has an integer overflow when processing fonts

Pillow vulnerability can cause write buffer overflow on BCn encoding

Nicht gemeldet

Nicht gemeldet

Nicht gemeldet

Nicht gemeldet

Nicht gemeldet

Nicht gemeldet