Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-44020An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2.PyPI · sushy-tools, virtualbmc · fixed in 0.21.1, 3.0.0
- CVE-2022-3697A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module.PyPI · ansible · fixed in 7.0.0
- CVE-2022-39366DataHub missing JWT signature checkPyPI · acryl-datahub · fixed in 0.8.45
- CVE-2022-43281wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() PyPI · wabt
- CVE-2022-3363Business Logic Errors in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0, 2.5.0a7
- CVE-2022-39286Execution with Unnecessary Privileges in JupyterAppPyPI · jupyter-core · fixed in 4.11.2
- CVE-2022-39348Twisted vulnerable to NameVirtualHost Host header injectionPyPI · twisted · fixed in 22.10.0rc1
- CVE-2022-43766Apache IoTDB prior to 0.13.3 allows DoSPyPI · apache-iotdb · fixed in 0.13.3
- CVE-2022-3644The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write modPyPI · pulp-ansible · fixed in 0.15.0
- CVE-2022-39327Improper Control of Generation of Code ('Code Injection') in Azure CLIPyPI · azure-cli · fixed in 2.40.0
- CVE-2022-37454The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers toPyPI · pysha3
- CVE-2022-37298Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control.PyPI · shinken
- CVE-2022-3327Missing Authentication for Critical Function in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0, 2.4.10
- CVE-2022-3607Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprintPyPI · octoprint · fixed in 1.8.3
- CVE-2022-41547Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzePyPI · mobsf · fixed in 0.9.3
- CVE-2022-41323In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service atPyPI · django · fixed in 3.2.16, 4.0.8, 4.1.2
- CVE-2022-3439Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0
- CVE-2022-3456Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0
- CVE-2022-3457Origin Validation Error in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0, 2.5.0a5
- CVE-2022-42906powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution.PyPI · powerline-gitstatus · fixed in 1.3.2
- CVE-2022-41380The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-yaml, democritus-file-system
- CVE-2022-41381The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-utility, democritus-file-system
- CVE-2022-41382The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-json, democritus-file-system
- CVE-2022-41383The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-archives, democritus-file-system
- CVE-2022-41384The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-domains, democritus-urls
- CVE-2022-41385The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-html, democritus-urls
- CVE-2022-41386The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-utility, democritus-urls
- CVE-2022-41387The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-pdfs, democritus-urls
- CVE-2022-42036The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-urls, democritus-csv
- CVE-2022-42037The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-asns, democritus-csv