Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-2013The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows locPyPI · python-keystoneclient · fixed in 0.2.4
- CVE-2013-4314The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name fielPyPI · pyopenssl · fixed in 0.13.1
- CVE-2013-5093The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, whiPyPI · graphite-web · fixed in 0.9.11
- CVE-2013-5942Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted PyPI · graphite-web · fixed in 0.9.11
- CVE-2013-5943Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML PyPI · graphite-web · fixed in 0.9.11
- CVE-2013-1443The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remoPyPI · django · fixed in 1.4.8, 1.5.4
- CVE-2013-2217cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact viPyPI · suds, suds-py3 · fixed in 0.7.0, 1.0.0, 1.4.4.1
- CVE-2013-4294The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly comPyPI · keystone · fixed in 2013.1.4
- CVE-2013-2256OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, whichPyPI · nova · fixed in 2013.1.3
- CVE-2013-4179The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to caPyPI · nova · fixed in 2013.2
- CVE-2013-4183The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deletingPyPI · cinder · fixed in 7.0.0a0
- CVE-2013-4202The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and ePyPI · cinder · fixed in 7.0.0a0
- CVE-2013-4259runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlPyPI · ansible · fixed in 1.2.3
- CVE-2013-4260lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite PyPI · ansible · fixed in 1.2.3
- CVE-2013-4278The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_publiPyPI · nova · fixed in 12.0.0a0
- CVE-2013-4315Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to rPyPI · django · fixed in 1.4.7, 1.5.3
- CVE-2013-4111The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the PyPI · python-glanceclient · fixed in 0.10.0
- CVE-2013-1909The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN)PyPI · qpid-python · fixed in 0.22
- CVE-2013-2161XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofePyPI · swift · fixed in 1.9.0
- CVE-2013-4155OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstonePyPI · swift · fixed in 1.9.1
- CVE-2013-1888pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.PyPI · pip · fixed in 1.3
- CVE-2013-2132bson/_cbsonmodule.c in the mongo-python-driver (aka.PyPI · pymongo · fixed in 2.5.2
- CVE-2013-1629pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allPyPI · pip · fixed in 1.3
- CVE-2013-1630pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, whicPyPI · pyshop · fixed in 0.7.1
- CVE-2013-1633easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on packPyPI · setuptools · fixed in 0.7
- CVE-2013-2209Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 anPyPI · reviewboard · fixed in 1.6.17, 1.7.10
- CVE-2013-2096OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a PyPI · nova · fixed in 12.0.0a0
- CVE-2013-2006OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintPyPI · keystone · fixed in 8.0.0a0
- CVE-2013-2059OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authenticatioPyPI · keystone · fixed in 8.0.0a0
- CVE-2013-0305The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissionPyPI · django · fixed in 1.3.6, 1.4.4