Learn more about known flask 2.1.2 vulnerabilities and licenses detected.

Learn more about known flask-cors 2.1.2 vulnerabilities and licenses detected.

Learn more about known Flask-AppBuilder 2.1.2 vulnerabilities and licenses detected.

February 18, 2020 - Hacking Flask Applications Executing arbitrary commands using the Werkzeug Debugger One of the very first web applications I made was developed using Flask. It was the best choice since it has a lot …

Learn more about known Flask 2.0.2 vulnerabilities and licenses detected.

June 30, 2021 - Security vulnerabilities and package health score for pip package flask

The Flask-Caching extension up to and including 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation.

The Werkzeug documentation warns users to never enable the debug console in production with or without a pin (https://werkzeug.palletsprojects.com/en/2.0.x/debug/#debugger-pin). This repo provides a sample application to play with the /console endpoint on a dummy Flask application.

NetApp is an industry leader in developing and implementing product security standards. Learn how we can help you maintain the confidentiality, integrity, and availability of your data.

Security vulnerabilities and package health score for pip package Flask 2.0.1

Learn more about known Flask 2.0.0 vulnerabilities and licenses detected.

Learn more about known flask 2.2.2 vulnerabilities and licenses detected.

November 30, 2025 - Path to vulnerable library: /tmp/ws-ua_20250921182043_LPXROH/python_OMWQYE/20250921182044/1/flask-3.1.2-py3-none-any.whl,/tmp/ws-ua_20250921182043_LPXROH/python_OMWQYE/20250921182044/flask-3.1.2-py3-none-any.whl · Vulnerability · Severity · CVSS · Exploit Maturity ·

Learn more about known flask 2.0.1 vulnerabilities and licenses detected.

2 days ago - Upon collating all necessary data, the exploit script can be executed to generate the Werkzeug console PIN. The script uses the assembled probably_public_bits and private_bits to create a hash, which then undergoes further processing to produce ...

May 11, 2023 - Flask has a HIGH severity security vulnerability CVE-2023-30861 [https://avd.aquasec.com/nvd/cve-2023-30861], which is fixed in versions 2.3.2 and 2.2.5, however aws-sam-cli requires Flask<2.1, which can only be satisfied via Flask version 2.0.3. It would be awesome if this could be fixed to thus reduce the surface area of attack of Python Flask projects using this.

July 5, 2018 - The template engine provided within the Flask framework may allow developers to introduce Server-Side Template Injection vulnerabilities. If you’re unfamiliar check out the whitepaper(PDF) by James Kettle. Briefly, this vulnerability allows an attacker to inject language/syntax into templates.

January 11, 2021 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States

May 9, 2024 - This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5. Publish Date: 2023-05-02 · URL: CVE-2023-30861 · Base Score Metrics: Exploitability Metrics: Attack Vector: Network ·

In this paper, we will deep dive into an interesting case of Client-Side Desync (CVE-2022-29361) on Werkzeug versions 2.1.0 to 2.1.1 (included). Using this vulnerability on a vulnerable host could lead to a full account takeover exploit via XSS.