Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XML External Entity (XXE) Vulnerability in scrapy/scrapy
Vulnerability Description
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
CVSS Information
N/A
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Vulnerability Title
Scrapy 安全漏洞
Vulnerability Description
Scrapy是一个用Python编写的自由且开源的网络爬虫框架。 Scrapy 存在安全漏洞，该漏洞源于使用 lxml.etree.fromstring 来解析不受信任的 XML 数据而不进行适当的验证，允许攻击者通过提交特制的 XML 数据来执行拒绝服务攻击、访问本地文件、生成网络连接或绕过防火墙。
CVSS Information
N/A
Vulnerability Type
N/A