Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-13921**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.PyPI · apache-skywalking
- CVE-2020-7698Command InjectionPyPI · gerapy · fixed in 0.9.3
- CVE-2020-15120Authorization Bypass in I hate moneyPyPI · ihatemoney · fixed in 4.1.5
- CVE-2020-7695HTTP Response SplittingPyPI · uvicorn · fixed in 0.11.7
- CVE-2020-7694Log InjectionPyPI · uvicorn · fixed in 0.11.7
- CVE-2020-15904A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via aPyPI · bsdiff4 · fixed in 1.2.0
- CVE-2020-15118Cross-Site Scripting in WagtailPyPI · wagtail · fixed in 2.7.4, 2.9.3
- CVE-2020-15110Possible pod name collisions in jupyterhub-kubespawnerPyPI · jupyterhub-kubespawner · fixed in 0.12.0
- CVE-2020-9485An issue was found in Apache Airflow versions 1.10.10 and below.PyPI · apache-airflow · fixed in 1.10.11rc1, 1.10.11
- CVE-2020-11983An issue was found in Apache Airflow versions 1.10.10 and below.PyPI · apache-airflow · fixed in 1.10.11rc1, 1.10.11
- CVE-2020-11982An issue was found in Apache Airflow versions 1.10.10 and below.PyPI · apache-airflow · fixed in 1.10.11rc1, 1.10.11
- CVE-2020-11981An issue was found in Apache Airflow versions 1.10.10 and below.PyPI · apache-airflow · fixed in 1.10.11rc1
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.PyPI · apache-airflow · fixed in 1.10.11rc1
- CVE-2020-15101Nested directory structure can lead to Uncontrolled Resource Consumption in freewvsPyPI · freewvs · fixed in 0.1.1
- CVE-2020-15100Uncontrolled Resource Consumption in freewvsPyPI · freewvs · fixed in 0.1.1
- CVE-2020-15105In Django Two-Factor Authentication, user passwords are stored in clear text in the Django sessionPyPI · django-two-factor-auth · fixed in 1.12
- CVE-2013-7489The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.PyPI · beaker
- CVE-2020-10177Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.PyPI · pillow · fixed in 7.1.0
- CVE-2020-11538In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different iPyPI · pillow · fixed in 7.1.0
- CVE-2020-10994In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.PyPI · pillow · fixed in 7.0.0, 7.1.0
- CVE-2020-10379In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.PyPI · pillow · fixed in 7.1.0
- CVE-2020-10378In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed PyPI · pillow · fixed in 7.1.0
- CVE-2020-4071Timing attack on django-basic-auth-ip-whitelistPyPI · django-basic-auth-ip-whitelist · fixed in 0.3.4
- CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) vPyPI · pyspark · fixed in 2.4.6
- CVE-2020-14942Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.PyPI · tendenci · fixed in 12.0.11
- CVE-2020-14019Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) isPyPI · rtslib-fb · fixed in 2.1.73
- CVE-2020-7932OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters.PyPI · omero-web · fixed in 5.6.3
- CVE-2018-16848A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3.PyPI · mistral · fixed in 7.0.4, 10.0.0
- CVE-2020-11090Uncontrolled Resource Consumption in Indy NodePyPI · indy-node · fixed in 1.12.3
- CVE-2020-10755An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versionsPyPI · cinder, os-brick · fixed in 14.1.0, 15.2.0, 16.1.0 and more