CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0435 – Excessive Attack Surface in pyload/pyload
https://notcve.org/view.php?id=CVE-2023-0435
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. Superficie de ataque excesiva en pyload/pyload del repositorio de GitHub anterior a 0.5.0b3.dev41. • https://github.com/pyload/pyload/commit/431ea6f0371d748df66b344a05ca1a8e0310cff3 https://huntr.dev/bounties/a3e32ad5-caee-4f43-b10a-4a876d4e3f1d • CWE-1125: Excessive Attack Surface •
CVSS: 9.8EPSS: 58%CPEs: 1EXPL: 5CVE-2023-0297 – Code Injection in pyload/pyload
https://notcve.org/view.php?id=CVE-2023-0297
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. An unauthenticated attacker can issue a crafted POST request to the flash/addcrypted2 endpoint to leverage this for code execution. pyLoad by default runs two services, the primary of which is on port 8000 and can not be used by external hosts. A secondary Click N Load service runs on port 9666 and can be used remotely without authentication. • https://www.exploit-db.com/exploits/51532 https://github.com/Small-ears/CVE-2023-0297 https://github.com/JacobEbben/CVE-2023-0297 https://github.com/overgrowncarrot1/CVE-2023-0297 http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0227 – Insufficient Session Expiration in pyload/pyload
https://notcve.org/view.php?id=CVE-2023-0227
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. Caducidad de sesión insuficiente en pyload/pyload del repositorio de GitHub anterior a 0.5.0b3.dev36. • https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9 https://huntr.dev/bounties/af3101d7-fea6-463a-b7e4-a48be219e31b • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0057 – Improper Restriction of Rendered UI Layers or Frames in pyload/pyload
https://notcve.org/view.php?id=CVE-2023-0057
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. Restricción inadecuada de capas o marcos de interfaz de usuario renderizados en pyload/pyload del repositorio de GitHub antes de 0.5.0b3.dev33. • https://github.com/pyload/pyload/commit/bd2a31b7de54570b919aa1581d486e6ee18c0f64 https://huntr.dev/bounties/12b64f91-d048-490c-94b0-37514b6d694d • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0055 – Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload
https://notcve.org/view.php?id=CVE-2023-0055
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. Cookie confidencial en sesión HTTPS sin atributo 'seguro' en el repositorio de GitHub pyload/pyload anterior a 0.5.0b3.dev32. • https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703 https://huntr.dev/bounties/ed88e240-99ff-48a1-bf32-8e1ef5f13cce • CWE-319: Cleartext Transmission of Sensitive Information CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute •