Sqlalchemy
Monthly
Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.