Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login pagePyPI · kiwitcms · fixed in 12.0
- CVE-2023-25171Kiwi TCMS has denial of service vulnerability on Password reset pagePyPI · kiwitcms · fixed in 12.0
- CVE-2023-25577Werkzeug may allow high resource usage when parsing multipart form data with many fieldsPyPI · werkzeug · fixed in 2.2.3
- CVE-2023-23934Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypassPyPI · werkzeug · fixed in 2.2.3
- CVE-2023-24816set_term_title command injection in ipythonPyPI · ipython · fixed in 8.10.0
- CVE-2023-0777Authentication Bypass by Primary Weakness in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2023-0286X.400 address type confusion in X.509 GeneralNamePyPI · cryptography · fixed in 39.0.1
- CVE-2022-47419Mayan EDMS Tag XSSPyPI · mayan-edms · fixed in 4.3.6
- CVE-2023-23931Cipher.update_into can corrupt memory in pyca cryptographyPyPI · cryptography · fixed in 39.0.1
- CVE-2020-36660paxswill EVE Ship Replacement Program User Information api.py information disclosurePyPI · eve-srp · fixed in 0.12.12
- CVE-2022-45786Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injectionPyPI · apache-age-python · fixed in 0.0.5
- CVE-2019-25101OnShift TurboGears HTTP Header controllers.py response splittingPyPI · turbogears · fixed in 1.0.11.11
- CVE-2023-23940OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypassPyPI · openzeppelin-cairo-contracts · fixed in 0.6.1
- CVE-2023-23969In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoPyPI · django · fixed in 3.2.17, 4.0.9, 4.1.6
- CVE-2023-24829Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchPyPI · apache-iotdb · fixed in 0.13.3
- CVE-2023-0591Path Traversal in ubi_readerPyPI · ubi-reader · fixed in 0.8.5
- CVE-2023-24830Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorizationPyPI · apache-iotdb · fixed in 0.13.3
- CVE-2023-24622isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leadPyPI · safeurl-python · fixed in 1.2
- CVE-2021-4315NYUCCL psiTurk experiment.py special elements used in a template enginePyPI · psiturk · fixed in 3.2.1
- CVE-2022-47951An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.PyPI · cinder, glance +1 · fixed in 19.1.2, 20.0.2, 23.0.1 and more
- CVE-2023-0470Cross-site Scripting (XSS) - Stored in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2023-0488Cross-site Scripting (XSS) - Stored in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev42
- CVE-2023-0509Improper Certificate Validation in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev44
- CVE-2023-0519Cross-site Scripting (XSS) - Stored in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2022-4510Path Traversal in binwalkPyPI · binwalk · fixed in 2.3.4
- CVE-2023-23611xblock-lti-consumer contain Missing Authorization in Grade Pass Back ImplementationPyPI · lti-consumer-xblock · fixed in 7.2.2
- CVE-2022-25882Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a pPyPI · onnx · fixed in 1.13.0
- CVE-2023-23608spotipy Path traversal vulnerability that may lead to type confusion in URI handling codePyPI · spotipy · fixed in 2.22.1
- CVE-2023-0438Cross-Site Request Forgery (CSRF) in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2023-0434Improper Input Validation in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev40