İçeriğe atla
Noroxi

palletsprojects kayıtları

palletsprojects üreticisine ait 27 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
1 · %3,7
Pre-auth RCE
1
Düzeltme kaydı olan
%100
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

27 kayıt
  • CVE-2019-14322
    47Planlayın

    In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

    YüksekCVSS 7,5Kavram kanıtıEPSS %56

    palletsprojects · werkzeug28 Tem 2019

  • CVE-2022-29361
    41Planlayın

    Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HT

    KritikCVSS 9,8Kavram kanıtıEPSS %8

    palletsprojects · werkzeug24 May 2022

  • CVE-2019-10906
    35İzleyin

    In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

    YüksekCVSS 8,6İstismar yokEPSS %4

    palletsprojects · jinja6 Nis 2019

  • CVE-2016-10745
    35İzleyin

    In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

    YüksekCVSS 8,6İstismar yokEPSS %4

    palletsprojects · jinja8 Nis 2019

  • CVE-2018-1000656
    31İzleyin

    The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large

    YüksekCVSS 7,5İstismar yokEPSS %4

    palletsprojects · flask20 Ağu 2018

  • CVE-2024-34069
    31İzleyin

    Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

    YüksekCVSS 7,5SilahlaştırılmışEPSS %3

    palletsprojects · werkzeug6 May 2024

  • CVE-2019-14806
    31İzleyin

    Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same mac

    YüksekCVSS 7,5İstismar yokEPSS %2

    palletsprojects · werkzeug9 Ağu 2019

  • CVE-2019-1010083
    31İzleyin

    The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.

    YüksekCVSS 7,5İstismar yokEPSS %2

    palletsprojects · flask17 Tem 2019

  • CVE-2023-25577
    30İzleyin

    Werkzeug may allow high resource usage when parsing multipart form data with many fields

    YüksekCVSS 7,5İstismar yokEPSS %1

    palletsprojects · werkzeug14 Şub 2023

  • CVE-2023-30861
    30İzleyin

    Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    palletsprojects · flask2 May 2023

  • CVE-2023-46136
    30İzleyin

    Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    palletsprojects · werkzeug25 Eki 2023

  • CVE-2026-7246
    28İzleyin

    [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

    YüksekCVSS 7,2İstismar yokEPSS %1

    palletsprojects · click30 Nis 2026

  • CVE-2024-49767
    27İzleyin

    Werkzeug possible resource exhaustion when parsing file data in forms

    OrtaCVSS 6,9İstismar yokEPSS %1

    palletsprojects · quart25 Eki 2024

  • CVE-2016-10516
    25İzleyin

    Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11

    OrtaCVSS 6,1İstismar yokEPSS %2

    palletsprojects · werkzeug23 Eki 2017

  • CVE-2020-28724
    25İzleyin

    Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

    OrtaCVSS 6,1İstismar yokEPSS %2

    palletsprojects · werkzeug18 Kas 2020

  • CVE-2024-49766
    25İzleyin

    Werkzeug safe_join not safe on Windows

    OrtaCVSS 6,3İstismar yokEPSS %1

    palletsprojects · werkzeug25 Eki 2024

  • CVE-2026-27199
    25İzleyin

    Werkzeug safe_join() allows Windows special device names

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    palletsprojects · werkzeug21 Şub 2026

  • CVE-2025-66221
    25İzleyin

    Werkzeug safe_join() allows Windows special device names

    OrtaCVSS 6,3İstismar yokEPSS %1

    palletsprojects · werkzeug28 Kas 2025

  • CVE-2026-21860
    25İzleyin

    Werkzeug safe_join() allows Windows special device names with compound extensions

    OrtaCVSS 6,3İstismar yokEPSS %0

    palletsprojects · werkzeug8 Oca 2026

  • CVE-2024-22195
    24İzleyin

    Jinja vulnerable to Cross-Site Scripting (XSS)

    OrtaCVSS 6,1İstismar yokEPSS %1

    palletsprojects · jinja10 Oca 2024

  • CVE-2020-28493
    22İzleyin

    Regular Expression Denial of Service (ReDoS)

    OrtaCVSS 5,3İstismar yokEPSS %4

    palletsprojects · jinja1 Şub 2021

  • CVE-2024-34064
    21İzleyin

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    palletsprojects · jinja6 May 2024

  • CVE-2024-56326
    21İzleyin

    Jinja has a sandbox breakout through indirect reference to format method

    OrtaCVSS 5,4İstismar yokEPSS %1

    palletsprojects · jinja23 Ara 2024

  • CVE-2025-27516
    21İzleyin

    Jinja sandbox breakout through attr filter selecting format method

    OrtaCVSS 5,4İstismar yokEPSS %1

    palletsprojects · jinja5 Mar 2025

  • CVE-2024-56201
    21İzleyin

    Jinja has a sandbox breakout through malicious filenames

    OrtaCVSS 5,4İstismar yokEPSS %0

    palletsprojects · jinja23 Ara 2024