Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16615An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2.PyPI · mlalchemy · fixed in 0.2.2
- CVE-2017-16616An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1.PyPI · pyanyapi · fixed in 0.6.1
- CVE-2017-16618An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12.PyPI · owlmixin · fixed in 2.0.0
- CVE-2015-7529sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an aPyPI · sosreport · fixed in 3.3
- CVE-2017-16228Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial PyPI · dulwich · fixed in 0.18.5
- CVE-2017-14695Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x beforePyPI · salt · fixed in 2016.3.8, 2016.11.8, 2017.7.2
- CVE-2017-14696SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of servicPyPI · salt · fixed in 2016.3.8, 2016.11.8, 2017.7.2
- CVE-2016-10516Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 PyPI · werkzeug · fixed in 0.11.11
- CVE-2017-15612mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escapPyPI · mistune · fixed in 0.8
- CVE-2015-6918salt before 2015.5.5 leaks git usernames and passwords to the log.PyPI · salt · fixed in 2015.5.5
- CVE-2017-1002153Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.PyPI · koji · fixed in 1.15.0
- CVE-2017-1000115Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repositoPyPI · mercurial · fixed in 4.3.1, 4.3
- CVE-2017-1000116Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.PyPI · mercurial · fixed in 4.3
- CVE-2017-5192When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2PyPI · salt · fixed in 2015.8.13, 2016.3.5, 2016.11.2
- CVE-2017-5200Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on PyPI · salt · fixed in 2015.8.13, 2016.3.5, 2016.11.2
- CVE-2015-7293Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.PyPI · plone · fixed in 5.0a1
- CVE-2015-5237protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.PyPI · protobuf · fixed in 3.4.0
- CVE-2015-7315Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attPyPI · plone, products-cmfplone · fixed in 4.0a1, 4.1a1, 4.2a1 and more
- CVE-2015-7316Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.xPyPI · plone · fixed in 4.0a1, 4.1a1, 4.2a1 and more
- CVE-2015-7318Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.PyPI · plone · fixed in 4.0a1
- CVE-2017-7549A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack PlatformPyPI · instack, instack-undercloud
- CVE-2015-0276Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.PyPI · kallithea · fixed in 0.2
- CVE-2015-4706Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectorPyPI · ipython · fixed in 3.2.0
- CVE-2015-4707Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors inPyPI · ipython · fixed in 3.2.0
- CVE-2015-5607Cross-site request forgery in the REST API in IPython 2 and 3.PyPI · ipython · fixed in 3.2.1, 2.4.1, 3.2.3
- CVE-2015-1864Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject aPyPI · kallithea · fixed in 0.2.1
- CVE-2017-2809An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5.PyPI · ansible-vault · fixed in 1.0.5
- CVE-2017-1002150python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protectionPyPI · python-fedora · fixed in 0.9.0
- CVE-2017-12612In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.PyPI · pyspark · fixed in 2.1.2
- CVE-2017-12794In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 dPyPI · django · fixed in 1.10.8, 1.11.5