Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-5143The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cauPyPI · django · fixed in 1.4.21, 1.7.9, 1.8.3
- CVE-2015-5144Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remPyPI · django · fixed in 1.4.21, 1.7.9, 1.8.3
- CVE-2015-5145validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified PyPI · django · fixed in 1.8.3
- CVE-2015-1851OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticatePyPI · cinder · fixed in 7.0.0a0
- CVE-2015-3010ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive inforPyPI · ceph-deploy · fixed in 1.5.23
- CVE-2015-4053The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local uPyPI · ceph-deploy · fixed in 1.5.25, 1.5.23
- CVE-2015-3982The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote atPyPI · django · fixed in 1.8.2
- CVE-2015-3646OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allPyPI · keystone · fixed in 2014.1.5, 2014.2.4
- CVE-2014-3598The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.PyPI · pillow · fixed in 2.5.3
- CVE-2015-0846django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to includPyPI · django-markupfield · fixed in 1.3.2
- CVE-2015-1852The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verificatPyPI · keystonemiddleware, python-keystoneclient · fixed in 1.6.0, 1.4.0
- CVE-2015-1856OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest versPyPI · swift · fixed in 2.3.0
- CVE-2015-0259OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requestPyPI · nova · fixed in 2014.1.4, 2014.2.3
- CVE-2014-9462The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repositoPyPI · mercurial · fixed in 3.2.4
- CVE-2014-9706The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with aPyPI · dulwich · fixed in 0.9.9, 0.9.10
- CVE-2015-0838Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arPyPI · dulwich · fixed in 0.9.9
- CVE-2015-2316The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions ofPyPI · django · fixed in 1.6.11, 1.7.7, 1.8c1
- CVE-2015-2317The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does notPyPI · django · fixed in 1.4.20, 1.6.11, 1.7.7 and more
- CVE-2015-2296The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks viPyPI · requests · fixed in 2.6.0
- CVE-2015-2241Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remPyPI · django · fixed in 1.7.6, 1.8b2
- CVE-2014-9684OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authentiPyPI · glance · fixed in 11.0.0a0
- CVE-2015-1881OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authentiPyPI · glance · fixed in 11.0.0a0
- CVE-2015-0260RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_rePyPI · kallithea, rhodecode · fixed in 0.2, 2.2.7
- CVE-2015-1613RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) getPyPI · rhodecode · fixed in 2.2.7
- CVE-2014-9623OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a PyPI · glance · fixed in 11.0.0a0
- CVE-2015-1195The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticatePyPI · glance · fixed in 11.0.0a0
- CVE-2014-9601Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size whPyPI · pillow · fixed in 2.7.0
- CVE-2015-0219Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) cPyPI · django · fixed in 1.4.18, 1.6.10, 1.7.3
- CVE-2015-0220The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leadPyPI · django · fixed in 1.4.18, 1.6.10, 1.7.3
- CVE-2015-0221The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a timePyPI · django · fixed in 1.4.18, 1.6.10, 1.7.3