View Code? Open in Web Editor
NEW
Flask tutorial found on flask.pocoo.org
Python 98.45%
C 0.20%
JavaScript 0.21%
CSS 0.21%
Tcl 0.82%
PowerShell 0.05%
Batchfile 0.05%
flask's People
Contributors
flask's Issues
CVE-2018-18074 - High Severity Vulnerability
Vulnerable Library - requestsv2.20.1
Python HTTP Requests for Humans™ ✨?✨
Library home page: https://github.com/requests/requests.git
Library Source Files (58)
* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.
/flask/Lib/site-packages/pip/_vendor/urllib3/packages/ordered_dict.py
/flask/Lib/site-packages/pip/_vendor/requests/auth.py
/flask/Lib/site-packages/pip/_vendor/chardet/euckrfreq.py
/flask/Lib/site-packages/pip/_vendor/chardet/gb2312prober.py
/flask/Lib/site-packages/pip/_vendor/chardet/enums.py
/flask/Lib/site-packages/pip/_vendor/chardet/langhebrewmodel.py
/flask/Lib/site-packages/pip/_vendor/chardet/sbcsgroupprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/sbcharsetprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/escprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/mbcharsetprober.py
/flask/Lib/site-packages/pip/_vendor/requests/_internal_utils.py
/flask/Lib/site-packages/pip/_vendor/chardet/langcyrillicmodel.py
/flask/Lib/site-packages/pip/_vendor/requests/hooks.py
/flask/Lib/site-packages/pip/_vendor/chardet/charsetprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/langgreekmodel.py
/flask/Lib/site-packages/pip/_vendor/chardet/langhungarianmodel.py
/flask/Lib/site-packages/pip/_vendor/requests/api.py
/flask/Lib/site-packages/pip/_vendor/requests/cookies.py
/flask/Lib/site-packages/pip/_vendor/idna/intranges.py
/flask/Lib/site-packages/pip/_vendor/chardet/jpcntx.py
/flask/Lib/site-packages/pkg_resources/_vendor/six.py
/flask/Lib/site-packages/pip/_vendor/chardet/chardistribution.py
/flask/Lib/site-packages/pip/_vendor/requests/status_codes.py
/flask/Lib/site-packages/pip/_vendor/chardet/cp949prober.py
/flask/Lib/site-packages/pip/_vendor/chardet/langthaimodel.py
/flask/Lib/site-packages/pip/_vendor/chardet/mbcssm.py
/flask/Lib/site-packages/pip/_vendor/idna/codec.py
/flask/Lib/site-packages/pip/_vendor/chardet/utf8prober.py
/flask/Lib/site-packages/pip/_vendor/chardet/latin1prober.py
/flask/Lib/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/init .py
/flask/Lib/site-packages/pip/_vendor/chardet/gb2312freq.py
/flask/Lib/site-packages/pip/_vendor/chardet/big5prober.py
/flask/Lib/site-packages/pip/_vendor/chardet/init .py
/flask/Lib/site-packages/pip/_vendor/chardet/charsetgroupprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/codingstatemachine.py
/flask/Lib/site-packages/pip/_vendor/urllib3/util/timeout.py
/flask/Lib/site-packages/pip/_vendor/chardet/escsm.py
/flask/Lib/site-packages/pip/_vendor/chardet/mbcsgroupprober.py
/flask/Lib/site-packages/pip/_vendor/urllib3/util/init .py
/flask/Lib/site-packages/pip/_vendor/requests/utils.py
/flask/Lib/site-packages/pip/_vendor/chardet/jisfreq.py
/flask/Lib/site-packages/pip/_vendor/urllib3/util/request.py
/flask/Lib/site-packages/pip/_vendor/chardet/euckrprober.py
/flask/Lib/site-packages/pip/_vendor/urllib3/util/response.py
/flask/Lib/site-packages/pip/_vendor/chardet/big5freq.py
/flask/Lib/site-packages/pip/_vendor/chardet/hebrewprober.py
/flask/Lib/site-packages/pip/_vendor/urllib3/contrib/ntlmpool.py
/flask/Lib/site-packages/pip/_vendor/chardet/euctwprober.py
/flask/Lib/site-packages/pip/_vendor/requests/structures.py
/flask/Lib/site-packages/pip/_vendor/requests/sessions.py
/flask/Lib/site-packages/pip/_vendor/chardet/euctwfreq.py
/flask/Lib/site-packages/pip/_vendor/chardet/compat.py
/flask/Lib/site-packages/pip/_vendor/chardet/langbulgarianmodel.py
/flask/Lib/site-packages/pip/_vendor/chardet/eucjpprober.py
/flask/Lib/site-packages/pip/_vendor/urllib3/packages/backports/makefile.py
/flask/Lib/site-packages/pip/_vendor/urllib3/util/url.py
/flask/Lib/site-packages/pip/_vendor/chardet/sjisprober.py
/flask/Lib/site-packages/pip/_vendor/chardet/langturkishmodel.py
Vulnerability Details
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Publish Date: 2018-10-09
URL: CVE-2018-18074
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-18074
Release Date: 2018-10-09
Fix Resolution: 2.20.0
Step up your Open Source Security Game with WhiteSource here
CVE-2015-9251 - Medium Severity Vulnerability
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
path: /flask/Lib/site-packages/werkzeug/debug/shared/jquery.js
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Dependency Hierarchy:
❌ jquery-1.11.3.min.js (Vulnerable Library)
Vulnerability Details
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
CVSS 3 Score Details (6.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Changed
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Change files
Origin: jquery/jquery@b078a62 #diff-bee4304906ea68bebadfc11be4368419
Release Date: 2015-10-12
Fix Resolution: Replace or update the following files: script.js, ajax.js, ajax.js
Step up your Open Source Security Game with WhiteSource here