Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23472Use of insecure random number generator in PasseoPyPI · passeo · fixed in 1.0.5
- CVE-2022-41902Out of bounds write in grappler in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41910Heap out of bounds read in `QuantizeAndDequantizeV2` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-4314Improper Privilege Management in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.2
- CVE-2022-44900A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackePyPI · py7zr · fixed in 0.20.1
- CVE-2022-46147Drag and Drop XBlock v2 has XSS Issues in Xblock Input FieldsPyPI · xblock-drag-and-drop-v2 · fixed in 3.0.0
- CVE-2022-45907In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.PyPI · torch · fixed in 1.13.1
- CVE-2022-45908In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winsPyPI · paddlepaddle · fixed in 2.4
- CVE-2022-41954Temporary File Information Disclosure VulnerabilityPyPI · mpxj · fixed in 10.14.1
- CVE-2022-2650Improper Restriction of Excessive Authentication Attempts in wger-project/wgerPyPI · wger · fixed in 2.2
- CVE-2022-3500A vulnerability was found in keylime.PyPI · keylime · fixed in 6.5.1
- CVE-2022-38649Apache Airflow Pinot provider allowed Command InjectionPyPI · apache-airflow · fixed in 2.3.0
- CVE-2022-40189Apache Airlfow Pig Provider RCEPyPI · apache-airflow · fixed in 2.3.0
- CVE-2022-40954Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesPyPI · apache-airflow · fixed in 2.3.0
- CVE-2022-41131Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)PyPI · apache-airflow-providers-apache-hive · fixed in 4.1.0
- CVE-2022-41952Uncontrolled Resource Consumption in Matrix Synapse PyPI · matrix-synapse · fixed in 1.53.0
- CVE-2022-43685CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.PyPI · ckan · fixed in 2.9.7
- CVE-2022-4105Cross-site Scripting (XSS) - Stored in kiwitcms/kiwiPyPI · kiwitcms · fixed in 11.6
- CVE-2022-41880ThreadUnsafeUnigramCandidateSampler Heap out of bounds in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41883Out of bounds segmentation fault due to unequal op inputs in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.10.1
- CVE-2022-41884Seg fault in `ndarray_tensor_bridge` due to zero and large inputs in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41885Overflow in `FusedResizeAndPadConv2D` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.4, 2.8.1, 2.9.1
- CVE-2022-41886Overflow in `ImageProjectiveTransformV2` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41887Overflow in `tf.keras.losses.poisson` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.9.3, 2.10.1
- CVE-2022-41888Unckecked rank size in `tf.image.generate_bounding_box_proposals` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41889Segfault via invalid attributes in `pywrap_tfe_src.cc` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41890`CHECK` fail in `BCast` overflow in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41891Segfault in `tf.raw_ops.TensorListConcat` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41893`CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41894Buffer overflow in `CONV_3D_TRANSPOSE` on TFLitePyPI · tensorflow · fixed in 2.8.4, 2.9.3, 2.10.1