Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-4251The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.PyPI · scipy · fixed in 0.12.1
- CVE-2013-2255HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-sidePyPI · cinder, keystone +2 · fixed in 7.0.0a0, 8.0.0a0, 0.4.0
- CVE-2009-5042python-docutils allows insecure usage of temporary filesPyPI · docutils · fixed in 0.6
- CVE-2018-21030Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin.PyPI · notebook · fixed in 5.5.0, 5.5.0rc1
- CVE-2019-12417A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page viewPyPI · airflow, apache-airflow · fixed in 1.10.6, 1.10.6rc1
- CVE-2010-4237Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate sigPyPI · mercurial · fixed in 1.6.4
- CVE-2012-5577Python keyring lib before 0.10 created keyring files with world-readable permissions.PyPI · keyring · fixed in 0.10
- CVE-2019-17400The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.PyPI · unoconv · fixed in 0.9.0
- CVE-2019-17626ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document PyPI · reportlab · fixed in 3.5.28
- CVE-2019-14858A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5.PyPI · ansible · fixed in 2.8.1, 2.9.0rc4, 2.8.6 and more
- CVE-2019-17545GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.PyPI · gdal · fixed in 3.0.2
- CVE-2017-18638send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.PyPI · graphite-web · fixed in 1.1.6
- CVE-2019-17109Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.PyPI · koji · fixed in 1.19.0, 1.14.3, 1.15.3 and more
- CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG PyPI · ansible · fixed in 2.6.20, 2.7.14, 2.8.6
- CVE-2019-17134Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bPyPI · octavia · fixed in 2.1.2, 3.2.0, 4.1.0
- CVE-2019-17206Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers tPyPI · rediswrapper · fixed in 0.3.0
- CVE-2019-16865An issue was discovered in Pillow before 6.2.0.PyPI · pillow · fixed in 6.2.0
- CVE-2019-16328In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes cPyPI · rpyc · fixed in 4.1.1, 4.1.2
- CVE-2019-13628wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side chaPyPI · wolfcrypt · fixed in 4.1.0
- CVE-2019-9423In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2
- CVE-2018-21019Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's PyPI · homeassistant · fixed in 0.67.0
- CVE-2019-16249OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/vidPyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 4.1.2.30
- CVE-2019-16224An issue was discovered in py-lmdb 0.97.PyPI · lmdb · fixed in 0.98
- CVE-2019-16225An issue was discovered in py-lmdb 0.97.PyPI · lmdb · fixed in 0.98
- CVE-2019-16226An issue was discovered in py-lmdb 0.97.PyPI · lmdb · fixed in 0.98
- CVE-2019-16227An issue was discovered in py-lmdb 0.97.PyPI · lmdb · fixed in 0.98
- CVE-2019-16228An issue was discovered in py-lmdb 0.97.PyPI · lmdb · fixed in 0.98
- CVE-2019-12105In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service.PyPI · supervisor · fixed in 4.0.3
- CVE-2019-15939An issue was discovered in OpenCV 4.1.0.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 4.1.1.26
- CVE-2019-15753In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatPyPI · os-vif · fixed in 1.15.2, 1.17.0