Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2024-37891

Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.

CVSS 3.1 · 4.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Netapp Python and 1 more
Products
Debian Linux Active Iq Unified Manager Urllib3 and 10 more
CVE-2021-43818

HTML Cleaner allows crafted and SVG embedded scripts to pass through

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

CVSS 3.1 · 8.2 High EPSS 2.7% KEV · Not listed
Vendors
Debian Fedoraproject Lxml and 3 more
Products
Debian Linux Fedora Lxml and 13 more
CVE-2023-4320

Satellite: arithmetic overflow in satellite

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule Satellite Maintenance and 1 more
CVE-2023-5189

Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 4 more
CVE-2024-7923

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Rhui Satellite Satellite Capsule and 2 more
CVE-2024-7012

Puppet-foreman: an authentication bypass vulnerability exists in foreman

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule Satellite Maintenance and 1 more
CVE-2024-27351

python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-24680

Django: denial-of-service in ``intcomma`` template filter

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2023-43665

python-django: Denial-of-service possibility in django.utils.text.Truncator

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-41164

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-36053

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 5 more
CVE-2024-42005

python-django: Potential SQL injection in QuerySet.values() and values_list()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-41991

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-39614

python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

CVSS 3.1 · 7.5 High EPSS 28.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-39330

python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2024-39329

python-django: Username enumeration through timing difference for users with unusable passwords

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2024-38875

python-django: Potential denial-of-service in django.utils.html.urlize()

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more