Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-35963`CHECK` failures in `FractionalAvgPoolGrad` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35960`CHECK` failure in `TensorListReserve` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35959`CHECK` failures in `AvgPool3DGrad` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35952`CHECK` failures in `UnbatchGradOp` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35940Int overflow in `RaggedRangeOp` in TensoflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35941`CHECK` failure in `AvgPoolOp` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.2
- CVE-2022-35937OOB read in `Gather_nd` op in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35939Out of bounds write in `scatter_nd` op in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35935`CHECK` failure in `SobolSample` via missing validation in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35934`CHECK` failure in tf.reshape in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-3221Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.3
- CVE-2022-36436OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerabPyPI · vncauthproxy · fixed in 1.2.0
- CVE-2022-38497LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.PyPI · lief · fixed in 0.12.1
- CVE-2022-38496LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.PyPI · lief · fixed in 0.12.2
- CVE-2022-38495LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.PyPI · lief · fixed in 0.12.1
- CVE-2022-38307LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file_offset() at /MachOPyPI · lief · fixed in 0.12.1
- CVE-2022-38306LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc.PyPI · lief · fixed in 0.12.1
- CVE-2022-3179Weak Password Requirements in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.2
- CVE-2022-3174Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.2
- CVE-2022-3175Missing Custom Error Page in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.2
- CVE-2022-38638Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.PyPI · casdoor
- CVE-2022-31006Hyperledger Indy DOS vulnerabilityPyPI · indy-node · fixed in 1.13.0.dev2
- CVE-2022-36087OAuthLib vulnerable DoS when attacker provides malicious IPV6 URIPyPI · oauthlib · fixed in 3.2.2, 3.2.1
- CVE-2022-3167Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.1
- CVE-2022-36082mangadex-downloader vulnerable to unauthorized file readingPyPI · mangadex-downloader · fixed in 1.7.2
- CVE-2022-36069Poetry Argument Injection vulnerability can lead to local Code ExecutionPyPI · poetry · fixed in 1.1.9
- CVE-2022-36070Poetry's Untrusted Search Path can lead to Local Code Execution on WindowsPyPI · poetry · fixed in 1.1.9
- CVE-2022-37189DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service.PyPI · mei2volpiano
- CVE-2022-40023Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse.PyPI · mako · fixed in 1.2.2
- CVE-2022-23451An authorization flaw was found in openstack-barbican.PyPI · barbican · fixed in 14.0.0