Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-6975Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-suPyPI · django · fixed in 1.11.19, 2.0.12, 2.1.7 and more
- CVE-2019-7560In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_PyPI · pyboolector · fixed in 3.1.0
- CVE-2019-7548SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.PyPI · sqlalchemy · fixed in 1.2.19, 1.2.18
- CVE-2019-1000007aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during errorPyPI · aioxmpp · fixed in 0.10.3
- CVE-2019-1000021slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 pluginPyPI · slixmpp · fixed in 1.4.2
- CVE-2018-11760When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the SparkPyPI · pyspark · fixed in 2.3.2, 2.2.3
- CVE-2019-7313www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect paramPyPI · buildbot · fixed in 1.8.1
- CVE-2017-18361In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of serviPyPI · colander · fixed in 1.7.0
- CVE-2019-6802CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a inPyPI · pypiserver · fixed in 1.2.6
- CVE-2017-15720In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.PyPI · apache-airflow · fixed in 1.9.0
- CVE-2017-17835In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.PyPI · apache-airflow · fixed in 1.9.0
- CVE-2017-17836In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases usedPyPI · apache-airflow · fixed in 1.9.0
- CVE-2018-20245The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checPyPI · apache-airflow · fixed in 1.10.1
- CVE-2019-2435Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python).PyPI · mysql-connector-python · fixed in 8.0.19
- CVE-2019-6446An issue was discovered in NumPy before 1.16.3.PyPI · numpy · fixed in 1.16.1, 1.16.3
- CVE-2017-1002152Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.PyPI · bodhi · fixed in 2.9.1, 3.3.0
- CVE-2017-1002157modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.PyPI · modulemd · fixed in 1.3.2
- CVE-2019-3498In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used PyPI · django · fixed in 1.11.18, 2.0.10, 2.1.5
- CVE-2019-3575Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.PyPI · sqla-yaml-fixtures · fixed in 1.0.0
- CVE-2018-16876ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to lePyPI · ansible · fixed in 2.5.14, 2.6.11, 2.7.5
- CVE-2018-20325There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python.PyPI · definitions
- CVE-2018-1000872OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerabilPyPI · pykmip · fixed in 0.8.0
- CVE-2018-1000814aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage thPyPI · aiohttp-session · fixed in 2.7.0
- CVE-2018-1000843Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 containPyPI · luigi · fixed in 2.8.0
- CVE-2018-20133ymlref allows code injection.PyPI · ymlref
- CVE-2018-20170OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones PyPI · keystone · fixed in 14.1.0
- CVE-2018-20096There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-20098There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-20099There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-20097There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3.PyPI · exiv2