Browse CVEs

CRITICAL 9.8 CVE-2023-45158 An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not t… Web2py after 2.24.1 Fix from $2,3002023-10-16 MEDIUM 6.1 CVE-2023-22432 Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website b… Web2py 2.23.1+ Fix from $1,6002023-03-06 MEDIUM 6.1 CVE-2022-33146 Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phi… Web2py 2.22.5+ Fix from $1,6002022-06-27 CRITICAL 9.8 CVE-2016-3953 The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded en… Web2py 2.14.2+ Fix from $2,3002018-02-06 CRITICAL 9.8 CVE-2016-3957 The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which migh… Web2py 2.14.2+ Fix from $2,3002018-02-06 HIGH 7.8 CVE-2016-3952 web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to exampl… Web2py 2.14.1+ Fix from $1,9502018-02-06 MEDIUM 5.5 CVE-2016-3954 web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: t… Web2py 2.14.2+ Fix from $1,6002018-02-06 MEDIUM 6.1 CVE-2015-6961 Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing … Web2py Patch available Fix from $1,6002017-10-18 CRITICAL 9.8 CVE-2016-10321 web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attack… Web2py after 2.14.5 Fix from $2,3002017-04-10 HIGH 8.8 CVE-2016-4808 Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user … Web2py after 2.14.5 Fix from $1,9502017-01-11 HIGH 7.5 CVE-2016-4806EPSS 10% Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server… Web2py after 2.14.5 Fix from $1,9502017-01-11