mlbrilliance

3 exploits Active since Oct 2018
CVE-2018-18074 NOMISEC HIGH STUB
python/requests < 2.20.0 - Credential Exposure via HTTPS-to-HTTP Redirect
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
CVSS 7.5
CVE-2019-10744 NOMISEC CRITICAL STUB
lodash < 4.17.12 - Prototype Pollution via defaultsDeep Function
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVSS 9.1
CVE-2020-26160 NOMISEC HIGH WRITEUP
jwt-go < 4.0.0-preview1 - Improper Audience Claim Validation
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
CVSS 7.5