Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21419Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventletPyPI · eventlet · fixed in 0.31.0
- CVE-2021-32090The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.PyPI · localstack · fixed in 0.12.10, 0.12.6.1
- CVE-2021-32091A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.PyPI · localstack · fixed in 0.12.6.1
- CVE-2021-32052In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs PyPI · django · fixed in 2.2.22, 3.1.10, 3.2.2
- CVE-2021-31800Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22.PyPI · impacket · fixed in 0.9.23
- CVE-2021-31542In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversaPyPI · django · fixed in 2.2.21, 3.1.9, 3.2.1
- CVE-2021-28359Apache Airflow Reflected XSS via Origin Query Argument in URLPyPI · apache-airflow · fixed in 1.10.15, 2.0.2
- CVE-2021-20228A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature whenPyPI · ansible · fixed in 2.9.19, 2.10.6rc1, 2.9.18rc1 and more
- CVE-2020-15225Denial of Service vulnerability in django-filterPyPI · django-filter · fixed in 2.4.0
- CVE-2021-28125Apache Superset Open RedirectPyPI · apache-superset, superset · fixed in 1.1.0
- CVE-2021-31607In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escaPyPI · salt · fixed in 3003rc1
- CVE-2021-29434Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldsPyPI · wagtail · fixed in 2.11.7, 2.11.6, 2.12.4
- CVE-2021-29431SSRF in Sydent due to missing validation of hostnamesPyPI · matrix-sydent · fixed in 2.3.0
- CVE-2021-29432Malicious users could control the content of invitation emailsPyPI · matrix-sydent · fixed in 2.3.0
- CVE-2021-29430Denial of service attack via memory exhaustionPyPI · matrix-sydent · fixed in 2.3.0
- CVE-2021-29433Denial of service (via resource exhaustion) due to improper input validationPyPI · matrix-sydent · fixed in 2.3.0
- CVE-2021-30459A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackePyPI · django-debug-toolbar · fixed in 1.11.1, 2.2.1, 3.2.1
- CVE-2021-21392Open redirect via transitional IPv6 addresses on dual-stack networksPyPI · matrix-synapse · fixed in 1.28.0, 1.28.0rc1
- CVE-2021-21393Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsPyPI · matrix-synapse · fixed in 1.28.0
- CVE-2021-21394Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsPyPI · matrix-synapse · fixed in 1.28.0
- CVE-2021-25925in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properPyPI · sickrage · fixed in 10.0.11.dev2, 10.0.12.dev1
- CVE-2021-25926In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validatPyPI · sickrage · fixed in 10.0.11.dev2, 10.0.12.dev1
- CVE-2021-21431Improper Input Validation in sopel-plugins.channelmgntPyPI · sopel-plugins-channelmgnt · fixed in 2.0.1
- CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.PyPI · indico · fixed in 2.3.4
- CVE-2021-21423Exposure of Version-Control Repository to an Unauthorized Control Sphere in projenPyPI · projen · fixed in 0.16.41
- CVE-2021-28658In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suPyPI · django · fixed in 2.2.20, 3.0.14, 3.1.8
- CVE-2021-21416Potential sensitive information disclosed in error reportsPyPI · django-registration · fixed in 3.1.2
- CVE-2021-29421models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.PyPI · pikepdf · fixed in 2.10.0
- CVE-2021-3447A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on maPyPI · ansible · fixed in 1.2.2
- CVE-2021-21333HTML injection in email and account expiry notificationsPyPI · matrix-synapse · fixed in 1.27.0