prolibre-ch/nobinobi-daily-follow-up
- Repos
- prolibre-ch/nobinobi-daily-follow-up
pyup/scheduled-update-2024-02-05
1 year, 7 months ago
Update zest.releaser from 9.1.1 to 9.1.2
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-02-05
1 year, 7 months ago
Update wheel from 0.41.2 to 0.42.0
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-02-05
1 year, 7 months ago
Update django-notifications-hq from 1.8.2 to 1.8.3
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-02-05
1 year, 7 months ago
Update nobinobi-child from 0.1.4.16 to 0.1.4.23
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-29
1 year, 8 months ago
Update coverage from 7.3.2 to 7.4.1
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-29
1 year, 8 months ago
Update nobinobi-child from 0.1.4.16 to 0.1.4.23
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-29
1 year, 8 months ago
Update werkzeug from 3.0.0 to 3.0.1
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-29
1 year, 8 months ago
Update django-notifications-hq from 1.8.2 to 1.8.3
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-29
1 year, 8 months ago
Update wheel from 0.41.2 to 0.42.0
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-22
1 year, 8 months ago
Update wheel from 0.41.2 to 0.42.0
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-22
1 year, 8 months ago
Update coverage from 7.3.2 to 7.4.0
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-22
1 year, 8 months ago
Update werkzeug from 3.0.0 to 3.0.1
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-22
1 year, 8 months ago
Update django-notifications-hq from 1.8.2 to 1.8.3
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-22
1 year, 8 months ago
Update nobinobi-child from 0.1.4.16 to 0.1.4.22
werkzeug 3.0.0, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.0 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.0 | <=2.3.7 , >=3.0.0,<3.0.1 |
show Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. |
| werkzeug | 3.0.0 | ==3.0.0 , <2.3.8 |
show Werkzeug 3.0.1 and 2.3.8 include a security fix: Slow multipart parsing for large parts potentially enabling DoS attacks. https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 |
| werkzeug | 3.0.0 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-01-15
1 year, 8 months ago
Update coverage from 7.3.2 to 7.4.0
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
Python 3 badge
URL
https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/)
Restructured Text
.. image:: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg
:target: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/"><img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
RDoc
{<img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/]
pyup.io badge
URL
https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg
Markdown
[](https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/)
Restructured Text
.. image:: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg
:target: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/"><img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg(Updates)!:https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
RDoc
{<img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/]