Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-0222ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackPyPI · django · fixed in 1.6.10, 1.7.3, 1.4.18
- CVE-2014-8991pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* fiPyPI · pip · fixed in 6.0
- CVE-2014-5277Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-miPyPI · docker-py · fixed in 0.5.3
- CVE-2014-0204OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, whPyPI · keystone · fixed in 8.0.0a0
- CVE-2012-5500The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titlePyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5508The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for paPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-6661Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which mPyPI · plone, zope2 · fixed in 4.2.3, 4.3b1, 2.13.19
- CVE-2014-3473Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (HPyPI · horizon · fixed in 8.0.0a0
- CVE-2014-3474Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack DashboarPyPI · horizon · fixed in 8.0.0a0
- CVE-2014-3708OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU coPyPI · nova · fixed in 2014.1.4, 2014.2.1
- CVE-2014-8333The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumptiPyPI · nova · fixed in 12.0.0a0
- CVE-2011-4103emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers toPyPI · django-piston · fixed in 0.2.2.1, 0.2.3
- CVE-2011-4104The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackePyPI · django-tastypie · fixed in 0.9.10
- CVE-2011-4953The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectorsPyPI · cobbler · fixed in 2.6.0
- CVE-2014-3137Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attaPyPI · bottle · fixed in 0.10.12, 0.11.7, 0.12.6
- CVE-2014-1927The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrarPyPI · python-gnupg · fixed in 0.3.6
- CVE-2014-1928The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbiPyPI · python-gnupg · fixed in 0.3.6
- CVE-2014-1929python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection throuPyPI · python-gnupg · fixed in 0.3.7
- CVE-2014-7960OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints PyPI · swift · fixed in 2.2.0
- CVE-2014-1829Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirePyPI · requests · fixed in 2.3.0
- CVE-2014-1830Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header PyPI · requests · fixed in 2.3.0
- CVE-2014-3641The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data fromPyPI · cinder · fixed in 2014.1.3
- CVE-2014-7231The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.PyPI · oslo-utils · fixed in 0.2.0
- CVE-2014-3608The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denialPyPI · nova · fixed in 2014.1.3
- CVE-2014-3621The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users PyPI · keystone · fixed in 8.0.0a0
- CVE-2014-7144OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification whePyPI · keystonemiddleware, python-keystoneclient · fixed in 0.11.0, 1.2.0
- CVE-2012-5485registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, relPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5486ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrarPyPI · plone, zope2 · fixed in 4.2.3, 4.3b1, 2.13.19
- CVE-2012-5487The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certaiPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5488python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to cPyPI · plone · fixed in 4.2.3, 4.3b1