Refine your search

4 vulnerabilities found for web2py by web2py

jvndb-2023-000101
Vulnerability from jvndb
Published
2023-10-16 16:11
Modified
2024-05-22 17:58
Severity ?
8.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
web2py vulnerable to OS command injection
Details
web2py web application framework contains an OS command injection vulnerability (CWE-78). Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000101.html",
  "dc:date": "2024-05-22T17:58+09:00",
  "dcterms:issued": "2023-10-16T16:11+09:00",
  "dcterms:modified": "2024-05-22T17:58+09:00",
  "description": "web2py web application framework contains an OS command injection vulnerability (CWE-78).\r\n\r\nMasashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000101.html",
  "sec:cpe": {
    "#text": "cpe:/a:web2py:web2py",
    "@product": "web2py",
    "@vendor": "web2py",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "8.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000101",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN80476432/index.html",
      "@id": "JVN#80476432",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-45158",
      "@id": "CVE-2023-45158",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-45158",
      "@id": "CVE-2023-45158",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "web2py vulnerable to OS command injection"
}

jvndb-2023-000020
Vulnerability from jvndb
Published
2023-02-28 15:00
Modified
2024-06-07 16:31
Severity ?
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Summary
web2py development tool vulnerable to open redirect
Details
The admin development tool included in the web2py source code contains an open redirect vulnerability (CWE-601). According to the developer, they do not recommend using the tool in operational environment or disclosing it on the Internet. Takuto Yoshikai of Aeye Security Lab reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000020.html",
  "dc:date": "2024-06-07T16:31+09:00",
  "dcterms:issued": "2023-02-28T15:00+09:00",
  "dcterms:modified": "2024-06-07T16:31+09:00",
  "description": "The admin development tool included in the web2py source code contains an open redirect vulnerability (CWE-601).\r\nAccording to the developer, they do not recommend using the tool in operational environment or disclosing it on the Internet.\r\n\r\nTakuto Yoshikai of Aeye Security Lab reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000020.html",
  "sec:cpe": {
    "#text": "cpe:/a:web2py:web2py",
    "@product": "web2py",
    "@vendor": "web2py",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000020",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN78253670/index.html",
      "@id": "JVN#78253670",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22432",
      "@id": "CVE-2023-22432",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22432",
      "@id": "CVE-2023-22432",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "web2py development tool vulnerable to open redirect"
}

jvndb-2022-000047
Vulnerability from jvndb
Published
2022-06-23 14:21
Modified
2024-06-18 10:48
Severity ?
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Summary
web2py vulnerable to open redirect
Details
web2py contains an open redirect vulnerability (CWE-601). Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000047.html",
  "dc:date": "2024-06-18T10:48+09:00",
  "dcterms:issued": "2022-06-23T14:21+09:00",
  "dcterms:modified": "2024-06-18T10:48+09:00",
  "description": "web2py contains an open redirect vulnerability (CWE-601).\r\n\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000047.html",
  "sec:cpe": {
    "#text": "cpe:/a:web2py:web2py",
    "@product": "web2py",
    "@vendor": "web2py",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000047",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN02158640/index.html",
      "@id": "JVN#02158640",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-33146",
      "@id": "CVE-2022-33146",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-33146",
      "@id": "CVE-2022-33146",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "web2py vulnerable to open redirect"
}

jvndb-2013-000040
Vulnerability from jvndb
Published
2013-05-20 15:16
Modified
2013-05-20 15:16
Severity ?
() - -
Summary
Cross-site scripting vulnerability in the web2py social bookmarking widget
Details
The social bookmarking widget (share.js) in web2py contains a cross-site scripting vulnerability. web2py is a framework for creating and designing web applications. The social bookmarking widget in web2py contains a cross-site scripting vulnerability. Yuji Kosuga of Everforth Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000040.html",
  "dc:date": "2013-05-20T15:16+09:00",
  "dcterms:issued": "2013-05-20T15:16+09:00",
  "dcterms:modified": "2013-05-20T15:16+09:00",
  "description": "The social bookmarking widget (share.js) in web2py contains a cross-site scripting vulnerability.\r\n\r\nweb2py is a framework for creating and designing web applications. The social bookmarking widget in web2py contains a cross-site scripting vulnerability.\r\n\r\nYuji Kosuga of Everforth Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000040.html",
  "sec:cpe": {
    "#text": "cpe:/a:web2py:web2py",
    "@product": "web2py",
    "@vendor": "web2py",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000040",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN10461119/index.html",
      "@id": "JVN#10461119",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2311",
      "@id": "CVE-2013-2311",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2311",
      "@id": "CVE-2013-2311",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Cross-site scripting vulnerability in the web2py social bookmarking widget"
}