Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2012-5489The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 anPyPI · plone, zope2 · fixed in 4.2.3, 4.3b1, 2.12.21 and more
- CVE-2012-5490Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5491z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveragingPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5492uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URLPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5493gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5494Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5495python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5496kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.PyPI · plone · fixed in 3.3.6, 4.0
- CVE-2012-5497membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5498queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5499python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5501at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5502Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5503ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.PyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5504Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to injecPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5505atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view withoutPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5506python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSPyPI · plone · fixed in 4.2.3, 4.3b1
- CVE-2012-5507AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtainPyPI · plone, zope2 · fixed in 4.2.3, 4.3b1, 2.13.19
- CVE-2013-2100The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSLPyPI · portage · fixed in 2.1.12.2
- CVE-2014-0480The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 dPyPI · django · fixed in 1.4.14, 1.5.9, 1.6.6
- CVE-2014-0481The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 beforPyPI · django · fixed in 1.4.14, 1.5.9, 1.6.6
- CVE-2014-0482The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before PyPI · django · fixed in 1.4.14, 1.5.9, 1.6.6 and more
- CVE-2014-0483The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidaPyPI · django · fixed in 1.4.14, 1.5.9, 1.6.6 and more
- CVE-2014-3589PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denPyPI · pillow · fixed in 2.3.2, 2.5.2
- CVE-2014-5251The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrePyPI · keystone · fixed in 8.0.0a0
- CVE-2014-5252The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokensPyPI · keystone · fixed in 8.0.0a0
- CVE-2014-5253OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidatedPyPI · keystone · fixed in 8.0.0a0
- CVE-2014-5356OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 APPyPI · glance · fixed in 11.0.0a0
- CVE-2014-3563Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors rePyPI · salt · fixed in 2014.1.10
- CVE-2014-3594Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 20PyPI · horizon · fixed in 8.0.0a0