Skip to content
OpenAdvisories

Vendor

pallets

18 known vulnerabilities.

Products

werkzeug 10 jinja 5 flask 3 Quart 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2024-34069 Public exploit

    Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

    Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

    pallets werkzeug werkzeug python-werkzeug Debian Ubuntu PyPI
  • High 8.0
    CVE-2023-46136 Public exploit

    Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

    Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

    pallets werkzeug werkzeug python-werkzeug Debian Alpine PyPI
  • High 7.5
    CVE-2023-30861 Public exploit

    Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

    Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

    pallets flask flask flask Debian Ubuntu PyPI