Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-1859(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allPyPI · numpy · fixed in 1.8.1
- CVE-2018-5268In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp whenPyPI · opencv-contrib-python, opencv-python · fixed in 3.4.1.15
- CVE-2018-5269In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integePyPI · opencv-contrib-python, opencv-python · fixed in 3.4.1.15
- CVE-2017-1000469Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execuPyPI · cobbler · fixed in 3.0.0
- CVE-2017-1000484By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website.PyPI · plone · fixed in 5.1.0, 4.3.16
- CVE-2017-1000481When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previousPyPI · plone, products-cmfplone · fixed in 4.3.16, 5.1.0, 4.3.17 and more
- CVE-2017-1000482A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor cPyPI · plone, products-cmfplone · fixed in 4.3.16, 5.1.0, 4.3.17 and more
- CVE-2017-1000483Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1.PyPI · plone · fixed in 4.3.16, 5.1.0
- CVE-2017-1000433pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled.PyPI · pysaml2 · fixed in 4.5.0
- CVE-2017-1000426MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclPyPI · mapproxy · fixed in 1.11.1
- CVE-2017-1000450In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer oPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-18009In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.PyPI · opencv-contrib-python, opencv-python · fixed in 3.4.1.15
- CVE-2017-17760OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.PyPI · opencv-contrib-python, opencv-python · fixed in 3.4.0.12
- CVE-2017-16876Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbPyPI · mistune · fixed in 0.8.1
- CVE-2017-17516scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by thePyPI · rtv
- CVE-2017-12155A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as worldPyPI · tripleo-heat-templates · fixed in 7.0.6
- CVE-2017-17554A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.PyPI · aubio · fixed in 0.4.7
- CVE-2017-17555The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other pPyPI · aubio · fixed in 0.4.7
- CVE-2017-17458In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the fPyPI · mercurial · fixed in 4.4.1
- CVE-2017-17051An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3.PyPI · nova · fixed in 16.0.4
- CVE-2017-17054In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when plaPyPI · aubio · fixed in 0.4.7
- CVE-2017-14176Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dPyPI · bzr
- CVE-2017-7550A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module.PyPI · ansible · fixed in 2.3.3.0, 2.4.1.0
- CVE-2017-16613An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1.PyPI · swauth · fixed in 1.3.0
- CVE-2017-1000246Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak enPyPI · pysaml2 · fixed in 4.6.0
- CVE-2017-16239In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be ablePyPI · nova · fixed in 14.0.10, 15.0.8, 16.0.3
- CVE-2017-0906The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vuPyPI · recurly · fixed in 2.0.5, 2.1.16, 2.2.22 and more
- CVE-2017-16762Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.PyPI · sanic · fixed in 0.5.1
- CVE-2017-16763An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0.PyPI · confire
- CVE-2017-16764An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3.PyPI · django-make-app