Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-0162The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allowPyPI · glance · fixed in 2013.2.4
- CVE-2014-3007Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharactPyPI · pillow · fixed in 2.5.0
- CVE-2014-0472The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 aPyPI · django · fixed in 1.4.11, 1.5.6, 1.6.3
- CVE-2014-0473The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF tokePyPI · django · fixed in 1.4.11, 1.5.6, 1.6.3
- CVE-2014-0474The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.PyPI · django · fixed in 1.4.11, 1.5.6, 1.6.3
- CVE-2014-1932The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, aPyPI · pillow · fixed in 2.3.1
- CVE-2014-1933The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses thPyPI · pillow · fixed in 2.3.1
- CVE-2014-0105The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retPyPI · python-keystoneclient · fixed in 0.7.0
- CVE-2014-0157Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 PyPI · horizon · fixed in 2013.2.4
- CVE-2014-0167The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not PyPI · nova · fixed in 2013.2.4
- CVE-2014-2828The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a deniaPyPI · keystone · fixed in 8.0.0a0
- CVE-2012-6130Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web scrPyPI · roundup · fixed in 1.4.20
- CVE-2012-6131Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script orPyPI · roundup · fixed in 1.4.20
- CVE-2012-6132Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otkPyPI · roundup · fixed in 1.4.20
- CVE-2014-2237The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-PyPI · keystone · fixed in 8.0.0a0
- CVE-2014-2573The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authPyPI · nova · fixed in 12.0.0a0
- CVE-2013-4188traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges toPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4189Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5,PyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4190Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x thPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4191zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including cPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4192sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspePyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4193typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unsPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4194The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain PyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4195Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.PyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4196The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properlPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4197member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delPyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-4198mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohPyPI · plone · fixed in 4.2.6, 4.3.2, 4.1.1
- CVE-2013-4199(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated PyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2014-1838The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbiPyPI · logilab-common · fixed in 0.61.0, 0.60.1
- CVE-2014-1839The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impacPyPI · logilab-common · fixed in 0.61.0, 0.60.1