Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-13346The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of thPyPI · mercurial · fixed in 4.6.1
- CVE-2018-13347mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.PyPI · mercurial · fixed in 4.6.1
- CVE-2018-13348The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaiPyPI · mercurial · fixed in 4.6.1
- CVE-2018-10855Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks.PyPI · ansible · fixed in 2.5.5, 2.4.5.0
- CVE-2018-10874In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacPyPI · ansible · fixed in 2.4.6.0, 2.5.6, 2.6.1
- CVE-2017-18342In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data.PyPI · pyyaml · fixed in 5.1
- CVE-2018-1000516The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in ManPyPI · galaxy-app · fixed in 14.10.1, 15.01
- CVE-2018-1000518aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ServersPyPI · websockets · fixed in 5.0
- CVE-2018-1000519aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-liPyPI · aiohttp-session · fixed in 2.4.0
- CVE-2018-1000523topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of dPyPI · topydo
- CVE-2018-1000559qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in PyPI · qutebrowser · fixed in 1.3.3
- CVE-2017-7466Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems.PyPI · ansible · fixed in 2.3.0.0, 2.2.3.0
- CVE-2018-12104Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via PyPI · knowledge-repo · fixed in 0.9.0, 0.7.5
- CVE-2018-12423In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.PyPI · matrix-synapse · fixed in 0.31.2
- CVE-2018-10406An issue was discovered in Yelp OSXCollector.PyPI · osxcollector · fixed in 1.10
- CVE-2018-12291The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events fePyPI · matrix-synapse · fixed in 0.31.1
- CVE-2017-2592python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure.PyPI · oslo-middleware · fixed in 3.19.1, 3.8.1, 3.23.1
- CVE-2013-2233Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.PyPI · ansible · fixed in 1.2.1
- CVE-2018-10657Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusablPyPI · matrix-synapse · fixed in 0.28.1
- CVE-2016-9587Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems.PyPI · ansible · fixed in 2.1.4.0, 2.2.1.0
- CVE-2017-7893In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.PyPI · salt · fixed in 2016.3.6
- CVE-2018-1000159tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of IntegPyPI · tlslite-ng · fixed in 0.7.4
- CVE-2018-1000164gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" funPyPI · gunicorn · fixed in 19.5.0
- CVE-2018-1000167OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the foPyPI · suricata-update · fixed in 1.0.0b1
- CVE-2017-0359diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archivePyPI · diffoscope · fixed in 76, 77
- CVE-2014-6633The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.PyPI · tryton, trytond · fixed in 2.4.15, 2.6.14, 2.8.11 and more
- CVE-2018-0023Junos Snapshot Administrator (JSNAPy) world writeable default configuration file permissionPyPI · jsnapy · fixed in 1.3.0
- CVE-2018-9856Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via PyPI · kotti · fixed in 1.3.2, 2.0.0b2
- CVE-2014-3539base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call toPyPI · rope · fixed in 0.11.0
- CVE-2018-1002150Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write accessPyPI · koji · fixed in 1.15.1, 1.14.1, 1.13.1 and more