Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-4041Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to PyPI · plone · fixed in 4.3.10, 5.0.5, 5.1a2
- CVE-2016-4042Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.PyPI · plone · fixed in 5.0.5, 4.3.10, 5.1a2
- CVE-2016-4043Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions toPyPI · plone · fixed in 5.1a2
- CVE-2016-9909The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishanPyPI · html5lib · fixed in 0.999999999
- CVE-2016-9910The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishanPyPI · html5lib · fixed in 0.999999999, 0.99999999
- CVE-2017-5992Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.PyPI · openpyxl · fixed in 2.4.2, 2.4.1
- CVE-2013-7459Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers PyPI · pycrypto
- CVE-2017-5591An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includPyPI · sleekxmpp, slixmpp · fixed in 1.3.2, 1.2.4
- CVE-2016-9639Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.PyPI · salt · fixed in 2015.8.11
- CVE-2016-7147Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.xPyPI · plone · fixed in 4.3.12, 5.0.7
- CVE-2016-3176Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured aPyPI · salt · fixed in 2015.5.10, 2015.8.8
- CVE-2015-8034The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informaPyPI · salt · fixed in 2015.8.3
- CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitPyPI · moin · fixed in 1.9.8
- CVE-2016-7036python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.PyPI · python-jose · fixed in 1.3.2
- CVE-2016-10075The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious giPyPI · tqdm · fixed in 4.11.2
- CVE-2016-4807Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged inPyPI · web2py
- CVE-2016-4808Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a loggedPyPI · web2py · fixed in 2.14.6
- CVE-2016-9015Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not corrPyPI · urllib3 · fixed in 1.18.1
- CVE-2016-6580A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer PyPI · priority · fixed in 1.2.0
- CVE-2016-6581A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of servPyPI · hpack · fixed in 2.3.0
- CVE-2016-5851python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.PyPI · python-docx · fixed in 0.8.6
- CVE-2016-9964redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233PyPI · bottle · fixed in 0.12.11
- CVE-2016-9013Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whePyPI · django · fixed in 1.10.3, 1.9.11, 1.8.16
- CVE-2016-9014Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conPyPI · django · fixed in 1.8.16, 1.9.11, 1.10.3
- CVE-2016-7146MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, relatPyPI · moin · fixed in 1.9.9
- CVE-2016-7148MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross PyPI · moin · fixed in 1.9.9
- CVE-2016-9189Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related tPyPI · pillow · fixed in 3.3.2
- CVE-2016-9190Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "PyPI · pillow · fixed in 3.3.2
- CVE-2016-1000001flask-oidc version 0.1.2 and earlier is vulnerable to an open redirectPyPI · flask-oidc · fixed in 1.0.0
- CVE-2015-5162The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does PyPI · cinder, glance +1 · fixed in 7.0.2, 9.0.0, 14.0.0 and more