CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-3458
https://notcve.org/view.php?id=CVE-2012-3458
Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors. Beaker anteriores v1.6.4, cuando se usa PyCrypto para cifrar sesiones, usa AES en modo de cifrado ECB, lo que podría permitir a atacantes remotos obtener porciones de información sensible a través de vectores no especificados. • http://secunia.com/advisories/50226 http://secunia.com/advisories/50520 http://www.debian.org/security/2012/dsa-2541 http://www.openwall.com/lists/oss-security/2012/08/13/10 https://bugzilla.redhat.com/show_bug.cgi?id=809267 https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5 • CWE-310: Cryptographic Issues •
CVSS: 6.4EPSS: 3%CPEs: 9EXPL: 0CVE-2012-2135
https://notcve.org/view.php?id=CVE-2012-2135
The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors. El descodificador UTF-16 en Python v3.1 a v3.3 no actualiza la variable aligned_end después de llamar a la función unicode_decode_call_errorhandler, lo que permite a atacantes remotos obtener información sensible (la memoria del proceso) o provocar una denegación de servicio (por corrupción de memoria y caída la aplicación) a través de vectores no especificados. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389 http://bugs.python.org/issue14579 http://secunia.com/advisories/51087 http://secunia.com/advisories/51089 http://www.openwall.com/lists/oss-security/2012/04/25/2 http://www.openwall.com/lists/oss-security/2012/04/25/4 http://www.ubuntu.com/usn/USN-1615-1 http://www.ubuntu.com/usn/USN-1616-1 •
CVSS: 5.0EPSS: 16%CPEs: 58EXPL: 1CVE-2012-0845 – python: SimpleXMLRPCServer CPU usage DoS via malformed XML-RPC request
https://notcve.org/view.php?id=CVE-2012-0845
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header. SimpleXMLRPCServer.py en SimpleXMLRPCServer en Python antes de v2.6.8, v2.7.x antes de v2.7.3, v3.x antes de v3.1.5, y v3.2.x antes de v3.2.x, permite a atacantes remotos provocar una denegación de servicio (bucle infinito y consumo de CPU) a través de una solicitud XML-RPC POST que contiene una cantidad de datos más pequeña que lo especificado en la cabecera Content-Length. • http://bugs.python.org/issue14001 http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html http://python.org/download/releases/2.6.8 http://python.org/download/releases/2.7.3 http://python.org/download/releases/3.1.5 http://python.org/download/releases/3.2.3 http://secunia.com/advisories/50858 http://secunia.com/advisories/51024 http://secunia.com/advisories/51040 http:/ • CWE-399: Resource Management Errors •
CVSS: 2.6EPSS: 0%CPEs: 39EXPL: 0CVE-2011-4940 – python: potential XSS in SimpleHTTPServer's list_directory()
https://notcve.org/view.php?id=CVE-2011-4940
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding. La función list_directory en lib/SimpleHTTPServer.py en SimpleHTTPServer en Python anterior a v2.5.6c1, v2.6.x anterior a v2.6.7 RC2, y v2.7.x anterior a v2.7.2 no pone un parámetro charset en la cabecera Content-Type de HTTP, lo que hace más fácil para los atacantes remotos realizar ataques XSS contra Internet Explorer 7 a través de codificación UTF-7. • http://bugs.python.org/issue11442 http://jvn.jp/en/jp/JVN51176027/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063 http://secunia.com/advisories/50858 http://secunia.com/advisories/51024 http://secunia.com/advisories/51040 http://www.securityfocus.com/bid/54083 http://www.ubuntu.com/usn/USN-1592-1 http://www.ubuntu.com/usn/USN-1596-1 http://www.ubuntu.com/usn/USN-1613-1 http://www.ubuntu.com/usn/USN-1613-2 https://bugzilla.redhat.com/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 1.9EPSS: 0%CPEs: 28EXPL: 0CVE-2011-4944 – python: distutils creates ~/.pypirc insecurely
https://notcve.org/view.php?id=CVE-2011-4944
Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file. Python v2.6 a través de 3.2 crea ~/.pypirc con permisos de lectura en todo el mundo antes de cambiar los datos que se han escrito, introduce una condición de carrera que permite a usuarios locales obtener un nombre de usuario y contraseña mediante la lectura de este archivo. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650555 http://bugs.python.org/file23824/pypirc-secure.diff http://bugs.python.org/issue13512 http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html http://secunia.com/advisories/50858 http://secunia.com/advisories/51024 http://secunia.com/advisories/51040 http://secunia.com/advisories/51087 http://secunia.com/advisories/51089 http://www • CWE-264: Permissions, Privileges, and Access Controls •