Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-42039The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-lists, democritus-dicts
- CVE-2022-42040The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-algorithms, democritus-dicts
- CVE-2022-42041The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-file-system, democritus-hashes
- CVE-2022-42042The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-networking, democritus-hashes
- CVE-2022-42043The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-xml, democritus-html
- CVE-2022-42044The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-asns, democritus-html
- CVE-2022-42731mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a uPyPI · django-mfa2 · fixed in 2.5.1, 2.6.1
- CVE-2022-3438Open Redirect in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0, 2.5.0a4
- CVE-2022-41672Session still functional after user is deactivatedPyPI · apache-airflow · fixed in 2.4.2rc1, 2.4.1rc1
- CVE-2022-3273Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0, 2.4.11a1
- CVE-2022-3376Weak Password Requirements in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.11a1, 2.5.0
- CVE-2022-3389Path Traversal in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.10
- CVE-2022-39280Regular expression denial of service in dparsePyPI · dparse · fixed in 0.5.2
- CVE-2022-40922A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOSPyPI · lief · fixed in 0.12.2
- CVE-2022-36551A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allowsPyPI · label-studio · fixed in 1.6.0, 1.5.0.post0
- CVE-2022-40923A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (PyPI · lief
- CVE-2022-3371No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0a3, 2.4.10
- CVE-2022-3364No limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.10, 2.5.0a3
- CVE-2022-39254When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarderPyPI · matrix-nio · fixed in 0.20
- CVE-2022-3355Cross-site Scripting (XSS) - Stored in inventree/inventreePyPI · inventree · fixed in 0.8.3
- CVE-2022-3326Weak Password Requirements in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.9
- CVE-2022-3292Use of Cache Containing Sensitive Information in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.9, 2.4.8
- CVE-2022-3298Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.8
- CVE-2022-3290Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.8
- CVE-2022-3272Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.8
- CVE-2022-3295Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.8
- CVE-2022-3301Improper Cleanup on Thrown Exception in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.8
- CVE-2022-21797Arbitrary Code ExecutionPyPI · joblib · fixed in 1.2.0
- CVE-2022-3269Session Fixation in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.7
- CVE-2022-39227Python-jwt subject to Authentication Bypass by SpoofingPyPI · python-jwt · fixed in 3.3.4