Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-2048Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions PyPI · django · fixed in 1.9.2
- CVE-2015-7546The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerPyPI · keystone, keystonemiddleware · fixed in 8.1.0, 9.0.0.0b2, 1.5.4 and more
- CVE-2015-8747The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted componePyPI · radicale · fixed in 1.1
- CVE-2015-8748Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user PyPI · radicale · fixed in 1.1
- CVE-2016-1505The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted pPyPI · radicale · fixed in 1.1
- CVE-2016-0737OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial ofPyPI · swift · fixed in 2.4.0
- CVE-2016-0738OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, whicPyPI · swift · fixed in 2.3.1, 2.5.1
- CVE-2015-8749The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes PyPI · nova · fixed in 12.0.1
- CVE-2016-1494The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent PyPI · rsa · fixed in 3.3
- CVE-2015-8557The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrarPyPI · pygments · fixed in 2.1
- CVE-2015-8213The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow rePyPI · django · fixed in 1.7.11, 1.8.7, 1.9rc2
- CVE-2015-5306OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access thPyPI · ironic-inspector, python-ironic-inspector-client · fixed in 2.2.2, 2.3.0, 0.2.5
- CVE-2015-5217providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update tPyPI · ipsilon · fixed in 1.2.0
- CVE-2015-5301providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check PyPI · ipsilon · fixed in 1.0.2, 1.2.0
- CVE-2015-5285CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spliPyPI · kallithea · fixed in 0.3
- CVE-2015-7713OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which alloPyPI · nova · fixed in 2014.2.4, 2015.1.2
- CVE-2015-5240Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, aPyPI · neutron · fixed in 7.0.0
- CVE-2015-3280OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, wPyPI · nova · fixed in 2014.2.4, 2015.1.2
- CVE-2015-5223OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest tPyPI · swift · fixed in 2.4.0
- CVE-2015-5251OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the sPyPI · glance · fixed in 2014.2.4, 2015.1.2
- CVE-2015-5286OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the PyPI · glance · fixed in 2014.2.4, 2015.1.2
- CVE-2015-7337The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript PyPI · ipython, notebook · fixed in 3.2.2, 4.0.5
- CVE-2015-6938Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter NotebooPyPI · ipython, notebook · fixed in 3.2.2, 4.0.5
- CVE-2015-3241OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, whPyPI · nova · fixed in 12.0.0.0b3, 112.0.0.0b3
- CVE-2015-3221OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authentPyPI · neutron · fixed in 2014.2.4, 2015.1.1
- CVE-2015-5963contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other verPyPI · django · fixed in 1.8.4, 1.7.10, 1.4.22
- CVE-2015-5964The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x PyPI · django · fixed in 1.7.10, 1.4.22
- CVE-2015-3219Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015PyPI · horizon · fixed in 8.0.0a0
- CVE-2015-5163The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticatPyPI · glance · fixed in 2015.1.2
- CVE-2015-3908Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fielPyPI · ansible · fixed in 1.9.2