Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-0435Excessive Attack Surface in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev41
- CVE-2023-22884Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowPyPI · apache-airflow, apache-airflow-providers-mysql · fixed in 2.5.1, 4.0.0
- CVE-2023-0398Cross-Site Request Forgery (CSRF) in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2023-0406Cross-Site Request Forgery (CSRF) in modoboa/modoboaPyPI · modoboa · fixed in 2.0.4
- CVE-2022-47950An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0.PyPI · swift · fixed in 2.28.1, 2.29.2, 2.30.1
- CVE-2021-32837mechanize vulnerable to ReDoSPyPI · mechanize · fixed in 0.4.6
- CVE-2023-22298Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitraryPyPI · pgadmin4 · fixed in 6.14
- CVE-2022-41703Apache Superset: SQL injection vulnerability in adhoc clausesPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-45438Apache Superset: Dashboard metadata information leakPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-43721Apache Superset: Open Redirect VulnerabilityPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-43720Apache Superset: Improper rendering of user inputPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-43719Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access APIPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-43718Apache Superset: Cross-Site Scripting vulnerability on upload formsPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2022-43717Apache Superset: Cross-Site Scripting on dashboardsPyPI · apache-superset · fixed in 1.5.3, 2.0.1
- CVE-2023-0297Code Injection in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev31
- CVE-2023-0227Insufficient Session Expiration in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev36
- CVE-2022-4885sviehb jefferson path traversalPyPI · jefferson · fixed in 0.4
- CVE-2016-15010University of Cambridge django-ucamlookup Lookup cross site scriptingPyPI · django-ucamlookup · fixed in 1.9.2
- CVE-2019-25095kakwa LdapCherry URL cross site scriptingPyPI · ldapcherry · fixed in 1.0.0
- CVE-2023-0057Improper Restriction of Rendered UI Layers or Frames in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev33
- CVE-2022-45875Apache DolphinScheduler: Remote command execution Vulnerability in script alert pluginPyPI · apache-dolphinscheduler · fixed in 3.0.2
- CVE-2023-0055Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyloadPyPI · pyload-ng · fixed in 0.5.0b3.dev32
- CVE-2019-25091nsupdate.info CSRF Cookie base.py cookie httponly flagPyPI · nsupdate · fixed in 0.13.0
- CVE-2021-4287ReFirm Labs binwalk Archive Extraction extractor.py symlinkPyPI · binwalk · fixed in 2.3.3
- CVE-2021-4286cocagne pysrp _ctsrp.py calculate_x information exposurePyPI · srp · fixed in 1.0.17
- CVE-2022-45197Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of SlixmPyPI · slixmpp · fixed in 1.8.3
- CVE-2022-4728Graphite Web Cookie cross site scriptingPyPI · graphite-web
- CVE-2022-4729Graphite Web Template Name cross site scriptingPyPI · graphite-web
- CVE-2022-4730Graphite Web Absolute Time Range cross site scriptingPyPI · graphite-web
- CVE-2022-4719Business Logic Errors in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5