Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: scrapy/scrapy 2.11.1 Clear all filters
TI-2024-03333 CVE-2024-3574 · GHSA-cw9j-q3vf-hrrv

Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy

Priority HIGH 72

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00648 Published 2024-04-16 Fixed in 2.11.1, 1.8.4 CWE-200
TI-2024-03331 CVE-2024-3572 · GHSA-7j7m-v7m3-jqm7

XML External Entity (XXE) Vulnerability in scrapy/scrapy

Priority HIGH 72

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00814 Published 2024-04-16 Fixed in 2.11.1, 1.8.4 CWE-409