Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
35 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. Details pyload will generate a log entry when attempting to sign in with faulty credentials. This entry will be in the form of Login failed for user 'USERNAME'. However, when supplied with a username containing a newline, this newline is not properly escaped. Newlines are also the delimiter between log entries. This allows the attacker to inject new log entries into the log file. PoC Run pyload in the default configuration by running the following command We can now sign in as the pyload user and view the logs at http://localhost:8000/logs. Any unauthenticated attacker can now make the following request to inject arbitrary logs. If we now were to look at the logs again, we see that the entry has successfully been injected. Impact Forged or otherwise, corrupted log files can be used to cover an attacker’s…
Recommended action: Upgrade to 0.5.0b3.dev77 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts. Details When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads. src/pyload/core/api/init.py::addpackage::L432 So if a package were created with the name the application would instead create the folder However, when editing packages there is no prevention in place and a user can just pick any arbitrary directory in the filesystem. src/pyload/webui/app/blueprints/jsonblueprint.py::editpackage::L195 Steps to reproduce 1. Login to a pyLoad instance 2. Go to "Queue" and create a new package with any name and a valid link 3. Click "Edit Package" on the newly created package and set the folder as "/config/scripts/downloadfinished/" 4. Restart the package 5. Check the server…
Recommended action: Upgrade to 0.5.0b3.dev75 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
Recommended action: Upgrade to 0.5.0b3.dev44 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
Recommended action: Upgrade to 0.5.0b3.dev42 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
Recommended action: Upgrade to 0.5.0b3.dev41 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
Recommended action: Upgrade to 0.5.0b3.dev40 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
Recommended action: Upgrade to 0.5.0b3.dev31 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to be part of version 0.5.0b3.dev36.
Recommended action: Upgrade to 0.5.0b3.dev36 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
Recommended action: Upgrade to 0.5.0b3.dev33 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in version 0.5.0b3.dev32.
Recommended action: Upgrade to 0.5.0b3.dev32 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.