Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-26249Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) VulnerabilityPyPI · red-dashboard · fixed in 0.1.7a
- CVE-2020-25449Cross Site Scripting (XSS) vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column.PyPI · cabot
- CVE-2020-29565An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x.PyPI · horizon · fixed in 15.3.2, 16.2.1, 18.3.3 and more
- CVE-2020-27348snapcraft may build snaps with incorrect LD_LIBRARY_PATHPyPI · snapcraft · fixed in 2.43.1, 4.4.4
- CVE-2020-27783A XSS vulnerability was discovered in python-lxml's clean module.PyPI · lxml · fixed in 4.6.2
- CVE-2020-26244Cryptographic issues in Python oicPyPI · oic · fixed in 1.2.1
- CVE-2020-29456Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTMLPyPI · papermerge · fixed in 1.5.2
- CVE-2020-26250Base class whitelist configuration ignored in OAuthenticatorPyPI · oauthenticator · fixed in 0.12.2
- CVE-2020-29367blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.PyPI · blosc2 · fixed in 0.1.7
- CVE-2020-29128petl before 1.68, in some configurations, allows resolution of entities in an XML document.PyPI · petl · fixed in 1.6.8
- CVE-2020-26243Memory leak in nanopbPyPI · nanopb · fixed in 0.3.9.7, 0.4.4
- CVE-2020-26232Open redirect in Jupyter ServerPyPI · jupyter-server · fixed in 1.0.6
- CVE-2020-26890Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, alPyPI · matrix-synapse · fixed in 1.20.0
- CVE-2020-28975svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of serviPyPI · scikit-learn · fixed in 1.0.1, 0.24.dev0
- CVE-2020-26215Open redirect in Jupyter NotebookPyPI · notebook · fixed in 6.1.5
- CVE-2020-28724Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.PyPI · werkzeug · fixed in 0.11.6
- CVE-2020-8897Robustness weakness in AWS KMS and Encryption SDKsPyPI · aws-encryption-sdk · fixed in 2.0.0
- CVE-2020-25658It was found that python-rsa is vulnerable to Bleichenbacher timing attacks.PyPI · rsa · fixed in 4.7
- CVE-2020-15275malicious SVG attachment causing stored XSS vulnerability in MoinMoinPyPI · moin · fixed in 1.9.11
- CVE-2020-25074The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request.PyPI · moin · fixed in 1.9.11
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riPyPI · apache-airflow · fixed in 1.10.11
- CVE-2020-28364A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectatPyPI · locust · fixed in 1.3.2
- CVE-2020-26214LDAP authentication bypass in AlertaPyPI · alerta-server · fixed in 8.1.0, 7.5.7
- CVE-2020-27589Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.PyPI · blackduck · fixed in 0.0.53
- CVE-2020-25592In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2020-17490The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.PyPI · salt · fixed in 2015.8.13, 2016.3.8, 2016.11.10 and more
- CVE-2020-16846An issue was discovered in SaltStack Salt through 3002.PyPI · salt · fixed in 2015.8.13, 2016.3.8, 2016.11.10 and more
- CVE-2020-15703aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale propertyPyPI · aptdaemon · fixed in 1.1.1
- CVE-2020-15278Unauthorized privilege escalation in Mod modulePyPI · red-discordbot · fixed in 3.4.1
- CVE-2020-15271Shell Command Execution in lookatmePyPI · lookatme · fixed in 2.3.0