Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-7401The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers PyPI · django · fixed in 1.8.15, 1.9.10
- CVE-2016-4972OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka)PyPI · murano, murano-dashboard +1 · fixed in 1.0.3, 2.0.1, 0.7.3 and more
- CVE-2016-1241Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated userPyPI · tryton, trytond · fixed in 3.2.17, 3.4.14, 3.8.8 and more
- CVE-2016-1242file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authentiPyPI · tryton, trytond · fixed in 3.2.17, 3.4.14, 3.6.12 and more
- CVE-2016-6298The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, wPyPI · jwcrypto · fixed in 0.3.2, 0.4.0
- CVE-2016-6186Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjecPyPI · django · fixed in 1.8.14, 1.9.8, 1.10rc1
- CVE-2016-4428Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticaPyPI · horizon · fixed in 8.0.2, 9.1.0
- CVE-2016-4985The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive PyPI · ironic · fixed in 4.2.5, 5.1.2
- CVE-2015-8914The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofinPyPI · neutron · fixed in 7.0.5, 8.1.1
- CVE-2016-5362The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing PyPI · neutron · fixed in 7.0.5, 8.1.1
- CVE-2016-5363The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing pPyPI · neutron · fixed in 7.1.0, 8.1.0
- CVE-2016-4911The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocatiPyPI · keystone · fixed in 9.0.1
- CVE-2016-3096The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitPyPI · ansible · fixed in 2.0.2.0, 1.9.6.1
- CVE-2016-3105The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repositoryPyPI · mercurial · fixed in 3.8, 3.8-rc
- CVE-2015-5271The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object StoragPyPI · tripleo-heat-templates · fixed in 0.8.7
- CVE-2016-0757OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow rPyPI · glance · fixed in 11.0.2
- CVE-2016-0740Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite PyPI · pillow · fixed in 3.1.1
- CVE-2016-0775Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial PyPI · pillow · fixed in 3.1.1
- CVE-2016-2533Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier alPyPI · pillow · fixed in 3.1.1
- CVE-2016-3068Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.PyPI · mercurial · fixed in 3.7.3
- CVE-2016-3069Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.PyPI · mercurial · fixed in 3.7.3
- CVE-2016-3630The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull PyPI · mercurial · fixed in 3.7.3
- CVE-2016-4009Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have uPyPI · pillow · fixed in 3.1.1
- CVE-2015-0861model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticPyPI · trytond · fixed in 3.2.10, 3.4.8, 3.6.5 and more
- CVE-2014-6276schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authentiPyPI · roundup · fixed in 1.5.1
- CVE-2016-1866Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbPyPI · salt · fixed in 2015.8.4
- CVE-2016-2140The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cowPyPI · nova · fixed in 12.0.3
- CVE-2015-5303The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack PyPI · tripleo-heat-templates · fixed in 0.8.10, 0.8.9
- CVE-2016-2512The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary wePyPI · django · fixed in 1.8.10, 1.9.3
- CVE-2016-2513The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users viaPyPI · django · fixed in 1.8.10, 1.9.3