Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-43781Permissions not properly checked in Invenio-Drafts-ResourcesPyPI · invenio-app-rdm, invenio-drafts-resources +1 · fixed in 6.0.5, 7.0.0.dev5, 0.13.7 and more
- CVE-2021-44227In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admPyPI · mailman · fixed in 2.1.38
- CVE-2021-25967CKAN - Stored Cross-Site Scripting (XSS) via SVG File UploadPyPI · ckan · fixed in 2.10.0, 2.9.4
- CVE-2021-3994Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskPyPI · django-helpdesk · fixed in 0.3.2
- CVE-2021-32061S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult elemenPyPI · s3scanner · fixed in 2.0.2
- CVE-2021-23654Improper Input ValidationPyPI · html-to-csv
- CVE-2021-25986Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications SectionPyPI · wiki · fixed in 0.7.9
- CVE-2021-41281Path traversal in Matrix SynapsePyPI · matrix-synapse · fixed in 1.47.1
- CVE-2021-43775Arbitrary file reading vulnerability in AimPyPI · aim · fixed in 3.1.0
- CVE-2021-40831Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devicesPyPI · awsiotsdk · fixed in 1.7.0
- CVE-2021-40830Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsPyPI · awsiotsdk · fixed in 1.6.1
- CVE-2021-40829TLS hostname validation issues within AWS IoT Device SDKs on macOSPyPI · awsiotsdk · fixed in 1.6.1
- CVE-2021-40828TLS hostname validation issues within AWS IoT Device SDKs on WindowsPyPI · awsiotsdk · fixed in 1.5.18
- CVE-2021-44144Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.PyPI · asterix-decoder · fixed in 0.7.2
- CVE-2021-3950Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskPyPI · django-helpdesk · fixed in 0.3.2, 0.3.1
- CVE-2021-42250Possible log injectionPyPI · apache-superset · fixed in 1.3.2
- CVE-2021-3945Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskPyPI · django-helpdesk · fixed in 0.3.1
- CVE-2021-3840A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote coPyPI · antilles-tools · fixed in 1.0.1
- CVE-2021-41972Credentials leakPyPI · apache-superset · fixed in 1.3.2
- CVE-2021-3572A flaw was found in python-pip in the way it handled Unicode separators in git references.PyPI · pip · fixed in 21.1
- CVE-2021-43572The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signaPyPI · starkbank-ecdsa · fixed in 2.0.1
- CVE-2021-39182Use of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyPyPI · enrocrypt · fixed in 1.1.4
- CVE-2021-41227Arbitrary memory read in `ImmutableConst`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41225A use of uninitialized value vulnerability in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41222Segfault due to negative splits in `SplitV`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41228Code injection in `saved_model_cli`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41220Use after free in `CollectiveReduceV2`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.7.0
- CVE-2021-41221Access to invalid memory during shape inference in `Cudnn*` opsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41216Heap buffer overflow in `Transpose`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41213Deadlock in mutually recursive `tf.function` objectsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more