(CVE-2016-10516)\n\n - Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. This does not include vulnerabilities belonging to this package's dependencies. get ('WERKZEUG_DEBUG_PIN') (CVE-2020-28724)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. (CVE-2020-28724)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security\nadvisory. You can find the PIN printed out on the standard output of your shell that runs the server Locate vulernable Werkzeug debug console at path vulnerable-site.com/console, but is locked by secret PIN number. A remote attacker could use this to inject arbitrary code via a field that contains an exception message. The console is locked and needs to be unlocked by entering the PIN. TEST YOUR DEFENSES IN REAL-TIME. This issue only affected Ubuntu 16.04 LTS. QUICK-START & CONFIGURATION. HTTP request smuggling vulnerability in Pallets Werkzeug can affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore. A Werkzeug security update has been released for Ubuntu 16.04 LTS and 18.04 LTS. (CVE-2020-28724)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-12-01T00:00:00", "type": "ubuntu", "title": "Werkzeug vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-14806", "CVE-2020-28724"], "modified": "2020-12-01T00:00:00", "id": "USN-4655-1", "href": "https://ubuntu.com/security/notices/USN-4655-1", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}]}. werkzeug redirect vulnerability - cnvd database | Vulners The vulnerability exists as the Docker containers uses the same machine ID.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-08-13T04:28:46", "type": "veracode", "title": "Insecure Randomness", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-14806"], "modified": "2019-09-11T05:51:57", "id": "VERACODE:21185", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-21185/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "osv": [{"lastseen": "2022-09-19T03:23:06", "description": "Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. affected Ubuntu 18.04 LTS. (CVE-2019-14806)\n\nIt was discovered that Werkzeug incorrectly handled certain URLs. National Vulnerability Database NVD. Second, set up a background payload listener. Nvd - Cve-2022-29361 - Nist Description It was discovered that Werkzeug has insufficient debugger PIN randomness. ( CVE-2019-14806) It was discovered that Werkzeug incorrectly handled certain URLs. (CVE-2020-28724)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/Ubuntu/release');\nif ( isnull(release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nrelease = chomp(release);\nif (! NOTE: the vendor's position is that . (CVE-2020-28724)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. An attacker is able to redirect a user to a malicious site via double slashes in the URL.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-11-19T06:02:13", "type": "veracode", "title": "Open Redirection", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28724"], "modified": "2020-12-01T18:17:43", "id": "VERACODE:27924", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27924/summary", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "osv": [{"lastseen": "2022-09-19T03:23:06", "description": "Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. Penetration Services. Based on project statistics from the GitHub repository for the PyPI package Werkzeug, we found that it has been starred 6,202 times, and that 0 other projects in the ecosystem are dependent on it. (CVE-2020-28724)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4655-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected python-werkzeug and / or python3-werkzeug packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-28724\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-14806\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/08/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/12/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/12/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python-werkzeug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python3-werkzeug\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2022 Canonical, Inc. / NASL script (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('ubuntu.inc');\ninclude('misc_func.inc');\n\nif ( ! (CVE-2019-14806)\n\n - Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. The text\n# itself is copyright (C) Canonical, Inc. See\n#
Think Like A Programmer Pdf, Guilt And Shame Worksheets For Adults, Logistic Regression Sigmoid Function Python, Iso Class 7 Cleanroom Requirements Pdf, Gobichettipalayam Tourist Places, How To Clean My Hoover Windtunnel, Glyceryl Stearate Se Vs Glyceryl Stearate,
