Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-1838modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.PyPI · salt · fixed in 2014.7.4
- CVE-2015-1839modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.PyPI · salt · fixed in 2014.7.4
- CVE-2017-5936OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which alloPyPI · nova-lxd · fixed in 13.1.1
- CVE-2016-10321web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-forPyPI · web2py · fixed in 2.14.6
- CVE-2016-1516OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.PyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2016-1517OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.PyPI · opencv-contrib-python, opencv-python · fixed in 3.3.1.11
- CVE-2017-0360file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "samePyPI · trytond · fixed in 4.2.3
- CVE-2017-7233Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on succesPyPI · django · fixed in 1.10.7, 1.9.13, 1.8.18
- CVE-2017-7234A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.sePyPI · django · fixed in 1.10.7, 1.9.13, 1.8.18
- CVE-2017-7400OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via aPyPI · horizon · fixed in 9.1.2, 10.0.3, 11.0.1
- CVE-2015-8234The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted PyPI · glance
- CVE-2016-9243HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.PyPI · cryptography · fixed in 1.5.3
- CVE-2015-8309Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" paPyPI · cherrymusic · fixed in 0.36.0
- CVE-2015-8310Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HPyPI · cherrymusic · fixed in 0.36.0
- CVE-2017-7266Netflix Security Monkey before 0.8.0 has an Open Redirect.PyPI · security-monkey · fixed in 0.8.0
- CVE-2016-10149XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML PyPI · pysaml2 · fixed in 4.5.0
- CVE-2017-5524Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive informatPyPI · plone · fixed in 4.3.12, 5.1b1, 5.0.7
- CVE-2017-7235An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1.PyPI · cfscrape · fixed in 1.8.0
- CVE-2017-7214An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1.PyPI · nova · fixed in 13.1.4, 14.0.5, 15.0.2
- CVE-2017-7200An SSRF issue was discovered in OpenStack Glance before Newton.PyPI · glance · fixed in 11.0.0a0
- CVE-2017-6952Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of sPyPI · capstone · fixed in 3.0.5rc2
- CVE-2017-5537The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated withPyPI · weblate · fixed in 2.10.1
- CVE-2017-6591There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.PyPI · django-epiceditor
- CVE-2016-7135Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary filPyPI · plone · fixed in 5.0.7, 4.3.12
- CVE-2016-7136z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a cPyPI · plone · fixed in 5.0.7, 4.3.12
- CVE-2016-7137Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers toPyPI · plone · fixed in 5.0.7, 4.3.12, 4.0a1
- CVE-2016-7138Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x thPyPI · plone · fixed in 5.0.7, 4.3.12, 4.0a1
- CVE-2016-7139Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x throuPyPI · plone · fixed in 5.0.6, 4.3.12, 5.0.7 and more
- CVE-2016-7140Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x tPyPI · plone · fixed in 5.0.7, 4.3.12, 4.0a1
- CVE-2016-10127PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.PyPI · pysaml2 · fixed in 4.5.0