Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-8549XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files vPyPI · pyamf · fixed in 0.8.0
- CVE-2019-16784Local Privilege Escalation present only on the Windows version of PyInstallerPyPI · pyinstaller · fixed in 3.6
- CVE-2020-6173TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.PyPI · tuf · fixed in 0.12.2
- CVE-2019-12398In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow mePyPI · apache-airflow · fixed in 1.10.5
- CVE-2020-5390PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it isPyPI · pysaml2 · fixed in 5.0.0
- CVE-2014-2686Ansible prior to 1.5.4 mishandles the evaluation of some strings.PyPI · ansible · fixed in 1.5.4
- CVE-2019-19911There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer PyPI · pillow · fixed in 6.2.2
- CVE-2019-5064An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 4.2.0.32
- CVE-2019-5063An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2
- CVE-2020-5310libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.PyPI · pillow · fixed in 6.2.2
- CVE-2020-5311libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.PyPI · pillow · fixed in 6.2.2
- CVE-2020-5312libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.PyPI · pillow · fixed in 6.2.2
- CVE-2020-5313libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.PyPI · pillow · fixed in 6.2.2
- CVE-2013-7062Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6,PyPI · plone · fixed in 3.3.6, 4.0.9, 4.1.6 and more
- CVE-2014-0161ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or PyPI · ovirt-engine-sdk-python · fixed in 3.4.0.7, 3.5.0.4
- CVE-2019-14864Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it PyPI · ansible · fixed in 2.7.15, 2.8.7, 2.9.1
- CVE-2019-14859A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding.PyPI · ecdsa · fixed in 0.13.3
- CVE-2019-20008In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will resulPyPI · pyarchery · fixed in 1.3.0
- CVE-2019-16789HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPyPI · waitress · fixed in 1.4.2, 1.4.1
- CVE-2019-16785HTTP Request Smuggling: LF vs CRLF handling in WaitressPyPI · waitress · fixed in 1.4.0
- CVE-2019-16786HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPyPI · waitress · fixed in 1.3.1, 1.4.0
- CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.PyPI · django · fixed in 1.11.27, 2.2.9, 3.0.1
- CVE-2019-12413In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specPyPI · apache-superset · fixed in 0.31, 0.31.0
- CVE-2019-12414In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLabPyPI · apache-superset · fixed in 0.32, 0.32.0
- CVE-2019-16778Heap buffer overflow in `UnsortedSegmentSum` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.0
- CVE-2014-8650python-requests-Kerberos through 0.5 does not handle mutual authenticationPyPI · requests-kerberos · fixed in 0.6
- CVE-2019-19702The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.PyPI · modoboa-dmarc · fixed in 1.2.0
- CVE-2013-2167python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypassPyPI · python-keystoneclient · fixed in 0.3.0
- CVE-2013-2166python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypassPyPI · python-keystoneclient · fixed in 0.3.0
- CVE-2013-0342The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packePyPI · pyrad · fixed in 2.1