Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-15795python-apt uses MD5 for validationPyPI · python-apt · fixed in 1.1.0
- CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argumePyPI · bleach · fixed in 3.1.2
- CVE-2020-6802In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tagsPyPI · bleach · fixed in 3.1.1
- CVE-2020-1747A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it pPyPI · pyyaml · fixed in 5.3.1
- CVE-2020-10684A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_faPyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6 and more
- CVE-2020-5252Malicious package may avoid detection in python auditingPyPI · safety · fixed in 1.8.7, 1.9.0
- CVE-2020-10799The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.PyPI · svglib · fixed in 0.9.4
- CVE-2020-5262GitHub personal access token leaking into temporary EasyBuild (debug) logsPyPI · easybuild, easybuild-framework · fixed in 4.1.2
- CVE-2019-10682django-nopassword before 5.0.0 stores cleartext secrets in the database.PyPI · django-nopassword · fixed in 5.0.0
- CVE-2020-1738A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified.PyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6
- CVE-2020-1740A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files.PyPI · ansible · fixed in 2.7.17, 2.8.11, 2.9.7 and more
- CVE-2020-1735A flaw was found in the Ansible Engine when the fetch module is used.PyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6 and more
- CVE-2020-1736A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified.PyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6
- CVE-2020-1753A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all PyPI · ansible · fixed in 2.7.18, 2.8.11, 2.9.7 and more
- CVE-2020-10594An issue was discovered in drf-jwt 1.15.x before 1.15.1.PyPI · drf-jwt · fixed in 1.15.1
- CVE-2020-10571An issue was discovered in psd-tools before 1.9.4.PyPI · psd-tools · fixed in 1.9.4
- CVE-2020-52402FA bypass through deleting devices in wagtail-2faPyPI · wagtail-2fa · fixed in 1.4.1
- CVE-2020-1739A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svPyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6 and more
- CVE-2020-9543OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong PyPI · manila · fixed in 7.4.1, 8.1.1, 9.1.1
- CVE-2020-10108In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.PyPI · twisted · fixed in 20.3.0rc1, 20.3.0
- CVE-2020-10109In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.PyPI · twisted · fixed in 20.3.0, 20.3.0rc1
- CVE-2016-1000111Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applicationPyPI · twisted · fixed in 16.3.1
- CVE-2020-1733A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unpriviPyPI · ansible · fixed in 2.7.17, 2.8.8, 2.9.6 and more
- CVE-2020-1737A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip moPyPI · ansible · fixed in 2.7.17, 2.8.9, 2.9.6
- CVE-2020-7212The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU coPyPI · urllib3 · fixed in 1.25.8
- CVE-2020-9402Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter PyPI · django · fixed in 1.11.29, 2.2.11, 3.0.4
- CVE-2020-1734A flaw was found in the pipe lookup plugin of ansible.PyPI · ansible · fixed in 2.7.17, 2.10.0rc1, 2.9.11 and more
- CVE-2014-4659Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in oppPyPI · ansible · fixed in 1.5.5
- CVE-2014-4658The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local usersPyPI · ansible · fixed in 1.5.5
- CVE-2014-4657The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrarPyPI · ansible · fixed in 1.5.4