RSS   Vulnerabilities for 'Requests'   RSS

2018-10-09
 
CVE-2018-18074

CWE-522
 

 
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

 
2015-03-18
 
CVE-2015-2296

 

 
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

 


Copyright 2024, cxsecurity.com

 

Back to Top