https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:57:00 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-02449 bdu:2023-02449 https://cve.radiocsirt.org/vuln/bdu:2023-02449 https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2023-23934 <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.</p> <p>Werkzeug &lt;= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.</p> <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.</p> <p>Werkzeug &lt;= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.</p> https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2023-23934 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0427 certfr-2023-avi-0427 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0427 https://cve.radiocsirt.org/vuln/euvd-2026-221567 EUVD-2026-221567 https://cve.radiocsirt.org/vuln/euvd-2026-221567 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23934 <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-23934 https://cve.radiocsirt.org/vuln/ghsa-px8h-6qxv-m22q <p><strong>Affected:</strong> PyPI: Werkzeug</p> <p>Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.</p> <p>Werkzeug &lt;= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.</p> <p><strong>Affected:</strong> PyPI: Werkzeug</p> <p>Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.</p> <p>Werkzeug &lt;= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.</p> https://cve.radiocsirt.org/vuln/ghsa-px8h-6qxv-m22q https://cve.radiocsirt.org/vuln/gsd-2023-23934 gsd-2023-23934 https://cve.radiocsirt.org/vuln/gsd-2023-23934 https://cve.radiocsirt.org/vuln/icsa-24-046-11 <p>A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.</p> <p>This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(&#34;text&#34;), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf&#39;s signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…</p> <p>A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.</p> <p>This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(&#34;text&#34;), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf&#39;s signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…</p> https://cve.radiocsirt.org/vuln/icsa-24-046-11 https://cve.radiocsirt.org/vuln/msrc_cve-2023-23934 msrc_CVE-2023-23934 https://cve.radiocsirt.org/vuln/msrc_cve-2023-23934 https://cve.radiocsirt.org/vuln/oesa-2023-1515 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-werkzeug, openEuler:20.03-LTS-SP3: python-werkzeug, openEuler:22.03-LTS: python-werkzeug, openEuler:22.03-LTS-SP1: python-werkzeug, openEuler:22.03-LTS-SP2: python-werkzeug</p> <p>*werkzeug* German noun: &#34;tool&#34;. Etymology: *werk* (&#34;work&#34;), *zeug* (&#34;stuff&#34;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: - An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack. - A full-featured request object with objects to interact with headers, query args, form data, files, and cookies. - A response object that can wrap other WSGI applications and handle streaming data. - A routing system for matching URLs to endpoints and generating URLs for endpoints, with an extensible system for capturing variables from URLs. - HTTP utilities to handle entity tags, cache control, dates, user agents, cookies, files, and more. - A threaded WSGI server for use while developing applications locally. - A test client for simulating HTTP requests during testing without requiring running a server. Werkzeug doesn&#39;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providing more structure and patterns for defining powerful applications.</p> <p>Security Fix(es):</p> <p>Werkzeug is a…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-werkzeug, openEuler:20.03-LTS-SP3: python-werkzeug, openEuler:22.03-LTS: python-werkzeug, openEuler:22.03-LTS-SP1: python-werkzeug, openEuler:22.03-LTS-SP2: python-werkzeug</p> <p>*werkzeug* German noun: &#34;tool&#34;. Etymology: *werk* (&#34;work&#34;), *zeug* (&#34;stuff&#34;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: - An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack. - A full-featured request object with objects to interact with headers, query args, form data, files, and cookies. - A response object that can wrap other WSGI applications and handle streaming data. - A routing system for matching URLs to endpoints and generating URLs for endpoints, with an extensible system for capturing variables from URLs. - HTTP utilities to handle entity tags, cache control, dates, user agents, cookies, files, and more. - A threaded WSGI server for use while developing applications locally. - A test client for simulating HTTP requests during testing without requiring running a server. Werkzeug doesn&#39;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providing more structure and patterns for defining powerful applications.</p> <p>Security Fix(es):</p> <p>Werkzeug is a…</p> https://cve.radiocsirt.org/vuln/oesa-2023-1515 https://cve.radiocsirt.org/vuln/pysec-2023-57 <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> https://cve.radiocsirt.org/vuln/pysec-2023-57 https://cve.radiocsirt.org/vuln/rhsa-2023:1018 <p>python-werkzeug: cookie prefixed with = can shadow unprefixed cookie python-werkzeug: high resource usage when parsing multipart form data with many fields</p> <p>python-werkzeug: cookie prefixed with = can shadow unprefixed cookie python-werkzeug: high resource usage when parsing multipart form data with many fields</p> https://cve.radiocsirt.org/vuln/rhsa-2023:1018 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-23934 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-werkzeug, Ubuntu:18.04:LTS: python-werkzeug, Ubuntu:20.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: python-werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-werkzeug, Ubuntu:18.04:LTS: python-werkzeug, Ubuntu:20.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: python-werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Browsers may allow &#34;nameless&#34; cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-23934 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1497 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen Denial of Service Angriff durchzuführen, Dateien zu manipulieren oder Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen Denial of Service Angriff durchzuführen, Dateien zu manipulieren oder Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1497