Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-3429IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arPyPI · ipython · fixed in 1.2.0
- CVE-2014-3517api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata PyPI · nova · fixed in 2013.2.4, 2014.1.2
- CVE-2014-3497Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or PyPI · swift · fixed in 2.0.0
- CVE-2014-4301Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 alloPyPI · ajenti · fixed in 1.2.21.7
- CVE-2014-3476OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, wPyPI · keystone · fixed in 8.0.0a0
- CVE-2014-3994Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as uPyPI · djblets · fixed in 0.7.30, 0.8.3
- CVE-2014-3995Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django aPyPI · djblets · fixed in 0.7.30, 0.8.3
- CVE-2013-7323python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.PyPI · python-gnupg · fixed in 0.3.7, 0.3.5
- CVE-2013-2014OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiplePyPI · keystone · fixed in 8.0.0a0
- CVE-2014-3840Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authePyPI · mayan-edms
- CVE-2014-3801OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allPyPI · openstack-heat · fixed in 5.0.0a0
- CVE-2013-4346The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attaPyPI · oauth2 · fixed in 1.9rc1
- CVE-2013-4347The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate PyPI · oauth2 · fixed in 1.9rc1
- CVE-2014-0012FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-cPyPI · jinja2 · fixed in 2.7.2, 2.7.3
- CVE-2014-1402The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows PyPI · jinja2 · fixed in 2.7.2
- CVE-2014-1418Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) CacPyPI · django · fixed in 1.4.13, 1.5.8, 1.6.5 and more
- CVE-2014-3730The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not proPyPI · django · fixed in 1.4.13, 1.5.8, 1.6.5 and more
- CVE-2014-3146Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scriptinPyPI · lxml · fixed in 3.3.5
- CVE-2014-3225Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrarPyPI · cobbler · fixed in 2.6.4, 2.4.7
- CVE-2014-3242SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction wiPyPI · soappy
- CVE-2014-3243SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memoryPyPI · soappy · fixed in 0.12.6
- CVE-2014-0056The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticatedPyPI · neutron · fixed in 2013.2.3
- CVE-2014-0134The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images aPyPI · nova · fixed in 12.0.0a0
- CVE-2014-1934tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack oPyPI · eyed3 · fixed in 0.7.5
- CVE-2013-6418PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer vPyPI · pywbem · fixed in 0.8.1
- CVE-2013-6444PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fiPyPI · pywbem · fixed in 0.8.1
- CVE-2013-7060Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to aPyPI · plone, products-cmfplone · fixed in 4.3.3
- CVE-2013-7061Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive informaPyPI · plone, products-cmfplone · fixed in 4.3.3
- CVE-2013-7110Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middlePyPI · transifex-client · fixed in 0.10, 0.11.0
- CVE-2014-2260Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticatedPyPI · ajenti · fixed in 1.2.14, 1.2.15