Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-4720Open Redirect in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5
- CVE-2022-4721Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5
- CVE-2022-4722Authentication Bypass by Primary Weakness in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5
- CVE-2022-4723Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5
- CVE-2022-4724Improper Access Control in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.5
- CVE-2022-40897Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packagPyPI · setuptools · fixed in 65.5.1
- CVE-2022-40898An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via aPyPI · wheel · fixed in 0.38.1
- CVE-2022-40899An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-CookiePyPI · future · fixed in 0.18.3
- CVE-2022-4644Open Redirect in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.4
- CVE-2022-4646Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.4
- CVE-2022-38060A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618.PyPI · kolla · fixed in 15.0.0.0rc1
- CVE-2022-4638collective.contact.widget widgets.py title cross site scriptingPyPI · collective-contact-widget · fixed in 1.13, 1.12
- CVE-2022-46421Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsPyPI · apache-airflow-providers-apache-hive · fixed in 5.0.0
- CVE-2022-44940Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.PyPI · patchelf, pypatchelf · fixed in 0.16.1.0
- CVE-2022-4572UBI Reader UBIFS File output.py ubireader_extract_files path traversalPyPI · ubi-reader · fixed in 0.8.5, 0.8.2
- CVE-2022-4589cyface Terms and Conditions Module views.py returnTo redirectPyPI · django-termsandconditions · fixed in 2.0.11
- CVE-2022-23531Arbitrary file write when scanning a specially-crafted local PyPI packagePyPI · guarddog · fixed in 0.1.5
- CVE-2022-23530GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI packagePyPI · guarddog · fixed in 0.1.8
- CVE-2022-32531Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname VerificationPyPI · apache-bookkeeper-client · fixed in 4.14.6
- CVE-2022-4526django-photologue Default Template photo_detail.html cross site scriptingPyPI · django-photologue · fixed in 3.16
- CVE-2022-4527collective.task table.py AssignedGroupColumn cross site scriptingPyPI · collective-task · fixed in 3.0.9, 3.0.10
- CVE-2022-4495collective.dms.basecontent column.py renderCell cross site scriptingPyPI · collective-dms-basecontent · fixed in 1.7
- CVE-2019-25078pacparser pacparser.c pacparser_find_proxy buffer overflowPyPI · pacparser · fixed in 1.4.0
- CVE-2022-4223The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities sucPyPI · pgadmin4 · fixed in 6.17
- CVE-2022-24439Remote Code Execution (RCE)PyPI · gitpython · fixed in 3.1.30
- CVE-2022-23485Invite code reuse via cookie manipulation in sentryPyPI · sentry · fixed in 22.11.0
- CVE-2022-4396RDFlib pyrdfa3 __init__.py _get_option cross site scriptingPyPI · pyrdfa3 · fixed in 3.6.2
- CVE-2022-23491Removal of TrustCor root certificatePyPI · certifi · fixed in 2022.12.7, 2022.12.07
- CVE-2022-46742Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.PyPI · paddlepaddle · fixed in 2.4.0
- CVE-2022-46741Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.PyPI · paddlepaddle · fixed in 2.4