Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-9160SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.PyPI · sickrage · fixed in 2018.03.09-1, 9.3.2
- CVE-2018-8768In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context.PyPI · notebook · fixed in 5.4.1
- CVE-2018-1000132Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in UnauthorPyPI · mercurial · fixed in 4.5.1
- CVE-2018-8097io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parametPyPI · eve · fixed in 0.7.5
- CVE-2018-1000126Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeratPyPI · ajenti-panel
- CVE-2018-7750transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.xPyPI · paramiko · fixed in 2.0.8, 2.1.5, 2.2.3 and more
- CVE-2018-1000080Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins asPyPI · ajenti-panel
- CVE-2018-1000081Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server CrashinPyPI · ajenti-panel
- CVE-2018-1000082Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to managePyPI · ajenti-panel
- CVE-2018-1000083Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a pPyPI · ajenti-panel
- CVE-2018-1000089Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value thatPyPI · django-anymail · fixed in 1.4
- CVE-2018-7749The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other PyPI · asyncssh · fixed in 1.12.1
- CVE-2018-7537An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.PyPI · django · fixed in 1.8.19, 1.11.11, 2.0.3
- CVE-2018-0524Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.PyPI · jubatus · fixed in 1.1.0
- CVE-2018-0525Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors.PyPI · jubatus · fixed in 1.1.0
- CVE-2018-7536An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.PyPI · django · fixed in 1.8.19, 1.11.11, 2.0.3
- CVE-2018-7753An issue was discovered in Bleach 2.1.x before 2.1.3.PyPI · bleach · fixed in 2.1.3
- CVE-2018-7490uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.PyPI · uwsgi · fixed in 2.0.17
- CVE-2017-18191An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1.PyPI · nova · fixed in 15.1.1, 16.1.2
- CVE-2018-7206An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3.PyPI · oauthenticator · fixed in 0.6.2, 0.7.3
- CVE-2017-15914Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.PyPI · borgbackup · fixed in 1.1.3
- CVE-2016-3953The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a harPyPI · web2py · fixed in 2.14.2
- CVE-2016-3954web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.PyPI · web2py · fixed in 2.14.2
- CVE-2018-6188django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentiallPyPI · django · fixed in 2.0.2, 1.11.10
- CVE-2018-6596webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret,PyPI · django-anymail · fixed in 1.2.1
- CVE-2018-6594lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive PyPI · pycrypto
- CVE-2017-15111keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via syPyPI · keycloak-httpd-client-install · fixed in 0.8
- CVE-2017-15112keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histoPyPI · keycloak-httpd-client-install · fixed in 0.8
- CVE-2018-5773An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5.PyPI · markdown2 · fixed in 2.3.6
- CVE-2014-1858__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.PyPI · numpy · fixed in 1.8.1