Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-15266Undefined behavior in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.0
- CVE-2020-15265Segfault in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.0
- CVE-2020-26891AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter.PyPI · matrix-synapse · fixed in 1.21.0
- CVE-2020-8929Ciphertext integrity weakness in TinkPyPI · tink · fixed in 1.5.0
- CVE-2020-27197TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substriPyPI · libtaxii · fixed in 1.1.118
- CVE-2020-26943An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0.PyPI · blazar-dashboard · fixed in 1.3.1, 2.0.1, 3.0.1
- CVE-2020-15251Privilege Escalation in Channelmgnt plug-in for SopelPyPI · sopel-plugins-channelmgnt · fixed in 1.0.3
- CVE-2020-15239Directory Traversal in xmpp-http-uploadPyPI · xmpp-http-upload · fixed in 0.4.0
- CVE-2020-25635A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is complePyPI · ansible · fixed in 2.10.1
- CVE-2020-13952In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto databasePyPI · apache-superset · fixed in 0.37.2
- CVE-2020-25626A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.PyPI · djangorestframework · fixed in 3.11.2
- CVE-2020-26137urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF controlPyPI · urllib3 · fixed in 1.25.9
- CVE-2020-15212Out of bounds access in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1, 2.2.1
- CVE-2020-15213Denial of service in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.1, 2.3.1
- CVE-2020-15214Out of bounds write in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.1, 2.3.1
- CVE-2020-15201Heap buffer overflow in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15202Integer truncation in Shard API usagePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15203Denial of Service in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15204Segfault in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15205Data leak in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15206Denial of Service in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15207Segfault and data corruption in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15208Data corruption in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15209Null pointer dereference in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15210Segmentation fault in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15211Out of bounds access in tensorflow-litePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15191Undefined behavior in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.1, 2.3.1
- CVE-2020-15192Memory leak in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.1, 2.3.1
- CVE-2020-15193Memory corruption in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.1, 2.3.1
- CVE-2020-15194Denial of Service in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more