Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-16406An issue was discovered in Mayan EDMS before 3.0.2.PyPI · mayan-edms · fixed in 3.0.2
- CVE-2018-16407An issue was discovered in Mayan EDMS before 3.0.3.PyPI · mayan-edms · fixed in 3.0.3
- CVE-2018-14572In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle filPyPI · conference-scheduler-cli
- CVE-2016-9605A flaw was found in cobbler software component version 2.6.11-1.PyPI · cobbler
- CVE-2018-1000225Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versionPyPI · cobbler
- CVE-2018-1000226Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versionPyPI · cobbler · fixed in 3.0.0
- CVE-2018-1000656The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in LargePyPI · flask · fixed in 0.12.3
- CVE-2011-2765Insecure temporary file handlingPyPI · pyro · fixed in 3.15
- CVE-2018-15560PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functiPyPI · pycryptodome · fixed in 3.6.6
- CVE-2018-13390Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnePyPI · cloudtoken · fixed in 0.1.24
- CVE-2018-10931It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.PyPI · cobbler · fixed in 3.0.0
- CVE-2017-12614It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack.PyPI · apache-airflow · fixed in 1.9.0
- CVE-2018-14574django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.PyPI · django · fixed in 2.0.8, 1.11.15
- CVE-2016-8640A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any tablePyPI · pycsw · fixed in 2.0.2, 1.8.6, 1.10.5
- CVE-2016-8614A flaw was found in Ansible before version 2.2.0.PyPI · ansible · fixed in 2.2.0.0
- CVE-2016-8628Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller.PyPI · ansible · fixed in 2.2.0.0
- CVE-2018-10898A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40.PyPI · tripleo-heat-templates · fixed in 8.0.3
- CVE-2018-10903A flaw was found in python-cryptography versions between >=1.9.0 and <2.3.PyPI · cryptography · fixed in 2.3
- CVE-2016-8647An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in PyPI · ansible · fixed in 2.2.1.0
- CVE-2017-7543A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10PyPI · neutron · fixed in 7.2.0-12.1, 8.3.0-11.1, 9.3.1-2.1 and more
- CVE-2018-14521An issue was discovered in aubio 0.4.6.PyPI · aubio · fixed in 0.4.7
- CVE-2018-14522An issue was discovered in aubio 0.4.6.PyPI · aubio · fixed in 0.4.7
- CVE-2018-14523An issue was discovered in aubio 0.4.6.PyPI · aubio · fixed in 0.4.7
- CVE-2018-14505mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py.PyPI · mitmproxy · fixed in 4.0.4
- CVE-2017-2673An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone).PyPI · keystone · fixed in 10.0.2, 11.0.1
- CVE-2017-7481Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe.PyPI · ansible · fixed in 2.3.1.0, 2.1.6.0, 2.2.3.0 and more
- CVE-2018-10875A flaw was found in ansible.PyPI · ansible · fixed in 2.5.6, 2.4.6.0, 2.6.1
- CVE-2018-13796An issue was discovered in GNU Mailman before 2.1.28.PyPI · mailman · fixed in 2.1.28
- CVE-2018-1334In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connectPyPI · pyspark · fixed in 2.2.2, 2.1.3
- CVE-2018-10895qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs.PyPI · qutebrowser · fixed in 1.4.1