← Back

Turbogears2

turbogears2

Vendor: Turbogears • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-5015
1Turbogears
1Turbogears2
Apr 29, 2026
Nov 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors.
CVE-2009-5014
1Turbogears
1Turbogears2
Apr 29, 2026
Nov 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a relat...Show more
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.Show less