Palletsprojects The Pallets Projects Werkzeug

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

Werkzeug may allow high resource usage when parsing multipart form data with many fields

Werkzeug possible resource exhaustion when parsing file data in forms

Werkzeug safe_join not safe on Windows

Werkzeug safe_join() allows Windows special device names

Werkzeug safe_join() allows Windows special device names

Werkzeug safe_join() allows Windows special device names with compound extensions

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass