Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-20060urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that diffPyPI · urllib3 · fixed in 1.23
- CVE-2018-19787An issue was discovered in lxml before 4.2.5.PyPI · lxml · fixed in 4.2.5
- CVE-2018-16859Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' paPyPI · ansible · fixed in 2.7.4, 2.8.1, 2.5.13 and more
- CVE-2018-19443The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances inPyPI · tryton · fixed in 5.0.1
- CVE-2018-19351Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as thePyPI · notebook · fixed in 5.7.1
- CVE-2018-19352Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs uPyPI · notebook · fixed in 5.7.2
- CVE-2018-18920Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100,PyPI · evm-py, py-evm · fixed in 0.2.0a33
- CVE-2018-8021Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code exPyPI · superset · fixed in 0.23.0, 0.23
- CVE-2018-16849A flaw was found in openstack-mistral.PyPI · mistral · fixed in 7.0.1
- CVE-2015-5159python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.PyPI · kdcproxy · fixed in 0.3.2
- CVE-2018-15750Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to detePyPI · salt · fixed in 2017.7.8, 2018.3.3, 2016.11.10
- CVE-2018-15751SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands vPyPI · salt · fixed in 2017.7.8, 2018.3.3, 2016.11.10
- CVE-2018-18548ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.PyPI · ajenti
- CVE-2018-16837Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen.PyPI · ansible · fixed in 2.7.1, 2.6.7, 2.5.11
- CVE-2018-18482An issue was discovered in libpg_query 10-1.0.2.PyPI · pg-query, pglast · fixed in 0.28
- CVE-2017-5934Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbiPyPI · moin · fixed in 1.9.10
- CVE-2018-18074The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-httpPyPI · requests · fixed in 2.20.0
- CVE-2018-1000805Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can PyPI · paramiko · fixed in 2.4.2, 2.3.3, 2.2.4 and more
- CVE-2018-1000808Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last ReferenPyPI · pyopenssl · fixed in 17.5.0
- CVE-2018-1000809privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-PyPI · privacyidea · fixed in 2.23.2
- CVE-2018-1000807Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object hanPyPI · pyopenssl · fixed in 17.5.0
- CVE-2018-17983cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.PyPI · mercurial · fixed in 4.7.2
- CVE-2018-16984An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts.PyPI · django · fixed in 2.1.2
- CVE-2018-16515Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper trPyPI · matrix-synapse · fixed in 0.33.2.1, 0.33.3.1
- CVE-2018-17175In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "onPyPI · marshmallow · fixed in 2.15.1, 3.0.0b9
- CVE-2018-14635When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassiPyPI · neutron · fixed in 13.0.0.0b2, 11.0.6, 12.0.4
- CVE-2018-14636Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.PyPI · neutron · fixed in 11.0.5, 12.0.3, 13.0.0.0b2
- CVE-2018-16552MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.PyPI · django-crm
- CVE-2018-16516helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.PyPI · flask-admin · fixed in 1.5.3
- CVE-2018-16405An issue was discovered in Mayan EDMS before 3.0.2.PyPI · mayan-edms, mayan-edms-ng · fixed in 3.0.2