Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2019-11236

python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

CVSS 3.0 · 6.1 Medium EPSS 2.1% KEV · Not listed
Vendors
Python Redhat
Products
Urllib3 Ansible Tower Enterprise Linux and 1 more
CVE-2018-25091

urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Python Redhat
Products
Urllib3 Enterprise Linux