Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-11457Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-passPyPI · django-crm
- CVE-2018-20998An issue was discovered in the arrayfire crate before 3.6.0 for Rust.PyPI · arrayfire · fixed in 3.6.0
- CVE-2019-10751All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary filePyPI · httpie · fixed in 1.0.3
- CVE-2019-15486django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.PyPI · django-js-reverse · fixed in 0.9.1
- CVE-2019-7617When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attackerPyPI · elastic-apm · fixed in 5.1.0
- CVE-2019-14751NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) iPyPI · nltk · fixed in 3.4.5
- CVE-2019-15149core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiatPyPI · mitogen · fixed in 0.2.8
- CVE-2019-14433An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2.PyPI · nova · fixed in 19.0.2, 17.0.12, 18.2.2
- CVE-2018-20858Recommender before 2018-07-18 allows XSS.PyPI · recommender-xblock · fixed in 1.3.1
- CVE-2019-14806Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same macPyPI · werkzeug · fixed in 0.15.3
- CVE-2019-14234An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.PyPI · django · fixed in 1.11.23, 2.1.11, 2.2.4
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.PyPI · pyspark · fixed in 2.3.3
- CVE-2019-14235An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.PyPI · django · fixed in 1.11.23, 2.1.11, 2.2.4
- CVE-2019-14233An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.PyPI · django · fixed in 1.11.23, 2.1.11, 2.2.4
- CVE-2019-14232An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.PyPI · django · fixed in 1.11.23, 2.1.11, 2.2.4
- CVE-2019-14493An issue was discovered in OpenCV before 4.1.1.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 4.1.1.26
- CVE-2019-14492An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 3.4.7.28, 4.1.1.26
- CVE-2019-14491An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 3.4.7.28, 4.1.1.26
- CVE-2019-10156A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of PyPI · ansible · fixed in 2.6.18, 2.7.12, 2.8.2
- CVE-2019-10141A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1.PyPI · ironic-inspector · fixed in 7.2.4, 8.2.1, 5.0.2 and more
- CVE-2019-10138A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform.PyPI · novajoin · fixed in 1.1.1
- CVE-2019-1020006invenio-app before 1.1.1 allows host header injection.PyPI · invenio-app · fixed in 1.1.1, 1.0.6
- CVE-2019-1020005invenio-communities before 1.0.0a20 allows XSS.PyPI · invenio-communities · fixed in 1.0.0a20
- CVE-2019-1020003invenio-records before 1.2.2 allows XSS.PyPI · invenio-records · fixed in 1.0.2, 1.1.1, 1.2.2
- CVE-2019-1020019invenio-previewer before 1.0.0a12 allows XSS.PyPI · invenio-previewer · fixed in 1.0.0a12
- CVE-2019-14322In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.PyPI · werkzeug · fixed in 0.15.5
- CVE-2019-1010142scapy 2.4.0 is affected by: Denial of Service.PyPI · scapy · fixed in 2.4.1
- CVE-2019-1010259SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.PyPI · salt · fixed in 2018.3.4
- CVE-2019-1010268Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE).PyPI · ladon · fixed in 1.0.0
- CVE-2019-1010083The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.PyPI · flask · fixed in 1.0