Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-24801HTTP Request Smuggling in twisted.webPyPI · twisted · fixed in 22.4.0
- CVE-2022-27177A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to PyPI · consoleme · fixed in 1.2.2
- CVE-2022-24798Insufficient password hash filtering in some IRRd queries and exportsPyPI · irrd · fixed in 4.2.3
- CVE-2022-24758Insertion of Sensitive Information into Log File affects Jupyter NotebookPyPI · notebook · fixed in 6.4.10
- CVE-2022-25598Apache DolphinScheduler user registration is vulnerable to ReDoS attacksPyPI · apache-dolphinscheduler · fixed in 2.0.5
- CVE-2022-22934An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.PyPI · salt · fixed in 3002.8, 3004.1, 3003.4
- CVE-2022-22935An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.PyPI · salt · fixed in 3002.8, 3003.4, 3004.1
- CVE-2022-22936An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.PyPI · salt · fixed in 3002.8, 3003.4, 3004.1
- CVE-2022-22941An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.PyPI · salt · fixed in 3002.8, 3003.4, 3004.1
- CVE-2022-24303Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.PyPI · pillow · fixed in 9.0.1
- CVE-2022-24776Open Redirect in Flask-AppBuilderPyPI · flask-appbuilder · fixed in 3.4.5
- CVE-2022-25568MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.PyPI · motioneye · fixed in 0.43.1b1
- CVE-2022-0315Insecure Temporary File in horovod/horovodPyPI · horovod · fixed in 0.24.0
- CVE-2022-24757Sensitive Auth & Cookie data stored in Jupyter server logsPyPI · jupyter-server · fixed in 1.15.4
- CVE-2021-4180An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname.PyPI · tripleo-heat-templates · fixed in 11.6.1
- CVE-2022-24766Insufficient Protection against HTTP Request Smuggling in mitmproxyPyPI · mitmproxy · fixed in 8.0.0
- CVE-2022-26184Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when usPyPI · poetry · fixed in 1.1.9
- CVE-2022-24302In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized infPyPI · paramiko · fixed in 2.10.1, 2.9.3
- CVE-2022-24770Improper Neutralization of Formula Elements in a CSV File in Gradio FlaggingPyPI · gradio · fixed in 2.8.11
- CVE-2022-21822NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without LimiPyPI · nvflare · fixed in 2.0.16
- CVE-2022-24761HTTP Request Smuggling in waitressPyPI · waitress · fixed in 2.1.1
- CVE-2021-23556Exposed Dangerous Method or FunctionPyPI · guake · fixed in 3.8.5
- CVE-2021-20180A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wPyPI · ansible · fixed in 2.8.19, 2.9.18
- CVE-2022-0959A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manuaPyPI · pgadmin4 · fixed in 6.7
- CVE-2022-0430Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpiePyPI · httpie · fixed in 3.1.0
- CVE-2022-27193CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE).PyPI · cvrf2csaf · fixed in 1.0.0rc2
- CVE-2021-45848Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sendiPyPI · nicotine-plus · fixed in 3.2.1
- CVE-2022-21187Command InjectionPyPI · libvcs, vcspull · fixed in 0.11.1, 1.11.1
- CVE-2022-0860Improper Authorization in cobbler/cobblerPyPI · cobbler · fixed in 3.3.2
- CVE-2022-0932Missing Authorization in saleor/saleorPyPI · saleor · fixed in 3.1.2