Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-44255Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration bPyPI · motioneye
- CVE-2022-0273Improper Access Control in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.16
- CVE-2022-0339Server-Side Request Forgery (SSRF) in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.16
- CVE-2022-24124The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/gPyPI · casdoor · fixed in 1.13.1
- CVE-2022-23599Cross-site Scripting and Open Redirect in Products.ATContentTypesPyPI · products-atcontenttypes · fixed in 3.0.6
- CVE-2022-0352Cross-site Scripting (XSS) - Reflected in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.16
- CVE-2021-32849Arbitrary command execution in GerapyPyPI · gerapy · fixed in 0.9.9
- CVE-2021-22570Nullptr Dereference in ProtobufPyPI · protobuf · fixed in 3.15.0
- CVE-2022-21697SSRF vulnerability (requires authentication)PyPI · jupyter-server-proxy · fixed in 3.2.1
- CVE-2022-0338Insertion of Sensitive Information into Log File in delgan/loguruPyPI · loguru · fixed in 0.5.3
- CVE-2021-45230Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the WebserverPyPI · apache-airflow · fixed in 2.2.0, 2.0.0b1
- CVE-2022-21699Execution with Unnecessary Privileges in ipythonPyPI · ipython · fixed in 6.0.0rc1, 7.16.3, 7.31.1 and more
- CVE-2022-21694OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the websitePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21690Cross-Site Scripting in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21692Improper Access Control in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21689Denial of Service in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21693Path traversal in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21691Improper Access Control in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21695Improper Access Control in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21688Out-of-bounds Read in OnionsharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21696Username spoofing in OnionSharePyPI · onionshare-cli · fixed in 2.5
- CVE-2022-21683Comment reply notifications sent to incorrect users in wagtailPyPI · wagtail · fixed in 2.15.2
- CVE-2021-44217In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer alPyPI · codechecker, codechecker-api · fixed in 6.18.2
- CVE-2021-4164Cross-Site Request Forgery (CSRF) in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2021-4171Business Logic Errors in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2021-4170Cross-site Scripting (XSS) - Stored in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2021-44649Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a CrosPyPI · django-cms · fixed in 3.4.7, 3.5.4, 3.6.1 and more
- CVE-2022-21668Pipenv's requirements.txt parsing allows malicious index url in commentsPyPI · pipenv · fixed in 2022.1.8
- CVE-2022-22846The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.PyPI · dnslib · fixed in 0.9.17
- CVE-2022-22821NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admiPyPI · nemo-toolkit · fixed in 1.6.0