Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25512FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.PyPI · freetakserver-ui
- CVE-2022-25510FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalPyPI · freetakserver · fixed in 1.9.8.5
- CVE-2022-25511An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywPyPI · freetakserver-ui
- CVE-2022-25508An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial oPyPI · freetakserver · fixed in 1.9.8.5
- CVE-2022-25506FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.PyPI · freetakserver-ui
- CVE-2022-25507FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.PyPI · freetakserver-ui
- CVE-2021-38296Apache Spark Key Negotiation VulnerabilityPyPI · pyspark · fixed in 3.1.3
- CVE-2022-24737Exposure of Sensitive Information to an Unauthorized Actor in httpiePyPI · httpie · fixed in 3.1.0
- CVE-2022-26661An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.PyPI · proteus, tryton +1 · fixed in 5.0.12, 6.0.5, 6.2.2 and more
- CVE-2022-26662An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.xPyPI · proteus, tryton +1 · fixed in 5.0.12, 6.0.5, 6.2.2 and more
- CVE-2022-0766Server-Side Request Forgery (SSRF) in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.17
- CVE-2022-0767Server-Side Request Forgery (SSRF) in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.17
- CVE-2022-0697Open Redirect in archivy/archivyPyPI · archivy · fixed in 1.7.0, 1.7.1
- CVE-2022-0869Multiple Open Redirect in nitely/spiritPyPI · django-spirit · fixed in 0.12.3
- CVE-2022-0845Code Injection in pytorchlightning/pytorch-lightningPyPI · lightning, pytorch-lightning · fixed in 1.6.0
- CVE-2022-23915Remote Code Execution (RCE)PyPI · weblate · fixed in 4.11.1
- CVE-2021-3620A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosePyPI · ansible · fixed in 2.9.27
- CVE-2022-21716Buffer Overflow in TwistedPyPI · twisted · fixed in 22.2.0
- CVE-2022-0577Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapyPyPI · scrapy · fixed in 1.8.2, 2.6.0, 2.6.1
- CVE-2021-3654A vulnerability was found in openstack-nova's console proxy, noVNC.PyPI · nova · fixed in 21.2.3, 22.2.3, 23.0.3
- CVE-2022-24710Cross-site Scripting in WeblatePyPI · weblate · fixed in 4.11
- CVE-2022-24288Apache Airflow: RCE in example DAGsPyPI · apache-airflow · fixed in 2.2.4
- CVE-2021-45229Apache Airflow: Reflected XSS via Origin Query Argument in URLPyPI · apache-airflow · fixed in 2.2.4rc1
- CVE-2022-23653B2 Command Line Tool TOCTOU application key disclosure PyPI · b2 · fixed in 3.2.1
- CVE-2022-23651b2-sdk-python TOCTOU application key disclosurePyPI · b2sdk · fixed in 1.14.1
- CVE-2022-0736Insecure Temporary File in mlflow/mlflowPyPI · mlflow · fixed in 1.23.1
- CVE-2021-45083An issue was discovered in Cobbler before 3.3.1.PyPI · cobbler · fixed in 3.3.1
- CVE-2021-45082An issue was discovered in Cobbler before 3.3.1.PyPI · cobbler · fixed in 3.3.1
- CVE-2022-21712Cookie and header exposure in twistedPyPI · twisted · fixed in 22.1.0
- CVE-2022-23561Out of bounds write in TFLitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.5.3, 2.6.3, 2.7.1