Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-11340util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_PyPI · matrix-sydent · fixed in 1.0.2
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypPyPI · django · fixed in 2.1.9, 2.2.2
- CVE-2019-11324The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS storPyPI · urllib3 · fixed in 1.24.2
- CVE-2017-11427Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalPyPI · python-saml · fixed in 2.4.0
- CVE-2019-11236In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.PyPI · urllib3 · fixed in 1.24.3
- CVE-2019-0216A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page viewPyPI · apache-airflow · fixed in 1.10.3b1, 1.10.3
- CVE-2019-0229A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-siPyPI · apache-airflow · fixed in 1.10.3b1, 1.10.3
- CVE-2016-10745In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.PyPI · jinja2 · fixed in 2.8.1
- CVE-2019-10906In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.PyPI · jinja2 · fixed in 2.10.1
- CVE-2019-10904Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.PyPI · roundup · fixed in 2.0.0alpha0, 2.0.0
- CVE-2019-10876An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.PyPI · neutron · fixed in 12.0.6, 11.0.7, 13.0.3
- CVE-2019-10868In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6,PyPI · trytond · fixed in 4.2.21, 4.4.19, 4.6.14 and more
- CVE-2019-10856In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc.PyPI · notebook · fixed in 5.7.8
- CVE-2019-10844nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which PyPI · nnabla · fixed in 1.0.10, 1.0.15
- CVE-2018-12680The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service inPyPI · coapthon
- CVE-2018-12679The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications PyPI · coapthon3
- CVE-2019-10255An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.PyPI · jupyterhub, notebook · fixed in 0.9.6, 5.7.8
- CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outPyPI · ansible · fixed in 2.5.15, 2.6.14, 2.7.8
- CVE-2019-3830A vulnerability was found in ceilometer before version 12.0.0.0rc1.PyPI · ceilometer · fixed in 12.0.0.0rc1
- CVE-2018-16856In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octPyPI · octavia · fixed in 3.0.2, 2.0.3, 2.1.0 and more
- CVE-2019-7539A code injection issue was discovered in ipycache through 2016-05-31.PyPI · ipycache
- CVE-2019-7537An issue was discovered in Donfig 0.3.0.PyPI · donfig · fixed in 0.4.0
- CVE-2019-5885Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secrePyPI · matrix-synapse · fixed in 0.34.0.1
- CVE-2019-5729Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.PyPI · splunk-sdk · fixed in 1.6.6
- CVE-2019-6690python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended.PyPI · python-gnupg · fixed in 0.4.4
- CVE-2019-9735An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.xPyPI · neutron · fixed in 12.0.6, 13.0.3, 11.0.7 and more
- CVE-2019-9644An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited PyPI · jupyter-notebook, notebook · fixed in 5.7.6
- CVE-2019-9710An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products.PyPI · webargs · fixed in 5.1.3
- CVE-2018-20244In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrarPyPI · apache-airflow · fixed in 1.10.2
- CVE-2019-7164SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.PyPI · sqlalchemy · fixed in 1.3.0b3