Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-4678The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrarPyPI · ansible · fixed in 1.6.4
- CVE-2014-4660Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow lPyPI · ansible · fixed in 1.5.5
- CVE-2019-20477PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., PoPyPI · pyyaml · fixed in 5.2b1, 5.2
- CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0.PyPI · nova · fixed in 18.2.4, 19.1.0, 20.1.0
- CVE-2014-4967Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access toPyPI · ansible · fixed in 1.6.7
- CVE-2014-4966Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substringPyPI · ansible · fixed in 1.6.7
- CVE-2014-9390Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial beforePyPI · mercurial · fixed in 3.2.3
- CVE-2020-6174TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.PyPI · tuf · fixed in 0.12.2
- CVE-2020-5236Catastrophic backtracking in regex allows Denial of Service in WaitressPyPI · waitress · fixed in 1.4.3
- CVE-2020-7471Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter PyPI · django · fixed in 1.11.28, 2.2.10, 3.0.3
- CVE-2012-6133Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML vPyPI · roundup · fixed in 1.4.20
- CVE-2020-7965flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input.PyPI · webargs · fixed in 5.5.3, 6.0.0b4
- CVE-2020-5227Feedgen Vulnerable to XML Denial of Service AttacksPyPI · feedgen · fixed in 0.9.0
- CVE-2020-5215Segmentation faultin TensorFlow when converting a Python string to tf.float16PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.2, 2.0.1
- CVE-2013-0294packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remotPyPI · pyrad · fixed in 2.1
- CVE-2013-1895The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authenticatioPyPI · py-bcrypt · fixed in 0.3
- CVE-2020-1932An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1.PyPI · apache-superset · fixed in 0.35.2
- CVE-2020-5224Session key exposure through session list in Django User SessionsPyPI · django-user-sessions · fixed in 1.7.1
- CVE-2020-7964An issue was discovered in Mirumee Saleor 2.x before 2.9.1.PyPI · saleor · fixed in 2.9.1
- CVE-2014-9720Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier PyPI · tornado · fixed in 3.2.2
- CVE-2020-7936An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone SitePyPI · plone · fixed in 4.3.20, 5.1.7, 5.2.2
- CVE-2020-7937An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be exePyPI · plone · fixed in 5.2.2
- CVE-2020-7938plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.PyPI · plone, plone-restapi · fixed in 5.2.2, 6.2.1
- CVE-2020-7939SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.PyPI · plone · fixed in 5.2.2
- CVE-2020-7940Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.PyPI · plone · fixed in 4.3.20, 5.1.7, 5.2.2 and more
- CVE-2020-7941A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without neediPyPI · plone, plone-app-contenttypes · fixed in 5.2.2, 2.1.6
- CVE-2019-16792HTTP Request Smuggling: Content-Length Sent Twice in WaitressPyPI · waitress · fixed in 1.4.0
- CVE-2019-16791downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolverPyPI · postfix-mta-sts-resolver · fixed in 0.5.1
- CVE-2019-17361In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.PyPI · salt · fixed in 2019.2.1, 2019.2.3
- CVE-2009-3724python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.PyPI · markdown2 · fixed in 1.0.1.14