https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:54:10 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02118 bdu:2024-02118 https://cve.radiocsirt.org/vuln/bdu:2024-02118 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0090 certfr-2024-avi-0090 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0090 https://cve.radiocsirt.org/vuln/euvd-2026-161340 EUVD-2026-161340 https://cve.radiocsirt.org/vuln/euvd-2026-161340 https://cve.radiocsirt.org/vuln/fkie_cve-2023-45857 <p>An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> <p>An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-45857 https://cve.radiocsirt.org/vuln/ghsa-wf5p-g6vw-rhxx <p><strong>Affected:</strong> npm: axios</p> <p>An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> <p><strong>Affected:</strong> npm: axios</p> <p>An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> https://cve.radiocsirt.org/vuln/ghsa-wf5p-g6vw-rhxx https://cve.radiocsirt.org/vuln/gsd-2023-45857 gsd-2023-45857 https://cve.radiocsirt.org/vuln/gsd-2023-45857 https://cve.radiocsirt.org/vuln/icsa-24-277-02 <p>Vulnerable versions of PowerSYSTEM Center utilize Axios NPM package 0.21.0, which contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. Vulnerable versions of PowerSYSTEM Center utilize Axios, which is vulnerable to Inefficient Regular Expression Complexity. Vulnerable versions of PowerSYSTEM Center utilize Axios 1.5.1, which can inadvertently reveal the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.</p> <p>Vulnerable versions of PowerSYSTEM Center utilize Axios NPM package 0.21.0, which contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. Vulnerable versions of PowerSYSTEM Center utilize Axios, which is vulnerable to Inefficient Regular Expression Complexity. Vulnerable versions of PowerSYSTEM Center utilize Axios 1.5.1, which can inadvertently reveal the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.</p> https://cve.radiocsirt.org/vuln/icsa-24-277-02 https://cve.radiocsirt.org/vuln/msrc_cve-2023-45857 msrc_CVE-2023-45857 https://cve.radiocsirt.org/vuln/msrc_cve-2023-45857 https://cve.radiocsirt.org/vuln/rhsa-2024:1640 <p>golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests GitPython: Blind local file inclusion axios: exposure of confidential data stored in cookies python-twisted: disordered HTTP pipeline response in twisted.web python-aiohttp: numerous issues in HTTP parser with header parsing python-cryptography: NULL-dereference when loading PKCS7 certificates golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads jinja2: HTML attribute injection when passing user input as keys to xmlattr filter aiohttp: follow_symlinks directory traversal vulnerability python-aiohttp: http request smuggling Django: denial-of-service in ``intcomma`` template filter python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()</p> <p>golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests GitPython: Blind local file inclusion axios: exposure of confidential data stored in cookies python-twisted: disordered HTTP pipeline response in twisted.web python-aiohttp: numerous issues in HTTP parser with header parsing python-cryptography: NULL-dereference when loading PKCS7 certificates golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads jinja2: HTML attribute injection when passing user input as keys to xmlattr filter aiohttp: follow_symlinks directory traversal vulnerability python-aiohttp: http request smuggling Django: denial-of-service in ``intcomma`` template filter python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()</p> https://cve.radiocsirt.org/vuln/rhsa-2024:1640 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-45857 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-45857 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0277 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, einen Phishing-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, einen Phishing-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0277