Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-14158Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are readPyPI · scrapy
- CVE-2017-14136OpenCV (Open Source Computer Vision Library) 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading anPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2015-5695Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas PyPI · designate
- CVE-2016-8752Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointiPyPI · apache-atlas
- CVE-2017-3150Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.PyPI · apache-atlas
- CVE-2017-3151Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionaliPyPI · apache-atlas
- CVE-2017-3152Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.PyPI · apache-atlas
- CVE-2017-3153Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.PyPI · apache-atlas
- CVE-2017-3154Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.PyPI · apache-atlas
- CVE-2017-3155Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.PyPI · apache-atlas
- CVE-2015-3206The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers tPyPI · kerberos, pykerberos · fixed in 1.1.6
- CVE-2015-4017Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.PyPI · salt · fixed in 2014.7.6
- CVE-2014-4616Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependPyPI · simplejson · fixed in 2.6.1
- CVE-2017-11424In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.PyPI · pyjwt · fixed in 1.5.1
- CVE-2017-11610The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated usPyPI · supervisor · fixed in 3.0.1, 3.1.4, 3.2.4 and more
- CVE-2017-12791Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote miniPyPI · salt · fixed in 2016.11.7, 2017.7.1
- CVE-2015-5081Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privilPyPI · django-cms · fixed in 3.0.14, 3.1.1
- CVE-2015-4082attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the ePyPI · attic · fixed in 0.15
- CVE-2017-12440Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verifPyPI · aodh · fixed in 6.0.1
- CVE-2017-12852The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation.PyPI · numpy · fixed in 1.13.3
- CVE-2017-12862In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow lPyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12863In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch.PyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-12864In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow.PyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2015-3156The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/dPyPI · trove · fixed in 4.0.0a0
- CVE-2015-2674Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the defaultPyPI · restkit
- CVE-2015-2687OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normallPyPI · nova · fixed in 15.0.0.0b1
- CVE-2015-6941win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in dePyPI · salt · fixed in 2015.5.6, 2015.8.1
- CVE-2015-7764Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.PyPI · lemur · fixed in 0.2.1, 0.1.5
- CVE-2009-5145Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.PyPI · zope2 · fixed in 2.12.5
- CVE-2017-12597OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when rePyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11