RSS   Vulnerabilities for 'Web2py'   RSS

2017-04-10
 
CVE-2016-10321

 

 
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

 
2017-01-11
 
CVE-2016-4808

 

 
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.

 
 
CVE-2016-4807

 

 
Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).

 
 
CVE-2016-4806

 

 
Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.

 
2013-05-22
 
CVE-2013-2311

CWE-79
 

 
Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

 


Copyright 2017, cxsecurity.com