Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-0306The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intePyPI · django · fixed in 1.3.6, 1.4.4
- CVE-2013-0270Keystone: openstack keystone: denial of service via large http request with long tenant namePyPI · keystone · fixed in 8.0.0a0
- CVE-2013-0282OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3)PyPI · keystone · fixed in 8.0.0a0
- CVE-2013-1664The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) EssePyPI · django · fixed in 1.3.6, 1.4.4
- CVE-2013-1665The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other prPyPI · django · fixed in 1.3.6, 1.4.4
- CVE-2013-0335Openstack nova: vnc proxy can connect to the wrong vmPyPI · nova · fixed in 12.0.0a0
- CVE-2013-1838OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remotePyPI · nova · fixed in 12.0.0a0
- CVE-2013-1840Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image requestPyPI · glance · fixed in 11.0.0a0
- CVE-2013-1865OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allPyPI · keystone · fixed in 2012.2.4
- CVE-2013-0212store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the PyPI · glance · fixed in 2012.2.3
- CVE-2012-6080Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 throPyPI · moin · fixed in 1.9.6
- CVE-2012-6081Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actPyPI · moin · fixed in 1.9.6
- CVE-2012-6082Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arPyPI · moin · fixed in 1.9.6
- CVE-2012-6495Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions PyPI · moin · fixed in 1.9.6
- CVE-2012-5625Openstack nova: information leak in libvirt lvm-backed instancesPyPI · nova · fixed in 12.0.0a0
- CVE-2012-5563OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated userPyPI · keystone · fixed in 8.0.0
- CVE-2012-5571Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handlingPyPI · keystone · fixed in 8.0.0a0
- CVE-2012-4571Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier fPyPI · keyring · fixed in 0.9.2
- CVE-2012-4520The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and diPyPI · django · fixed in 1.3.4, 1.4.2
- CVE-2012-4573The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protecPyPI · glance · fixed in 11.0.0a0
- CVE-2012-5482The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protecPyPI · glance · fixed in 11.0.0a0
- CVE-2012-3446Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name PyPI · apache-libcloud · fixed in 0.11.1
- CVE-2012-5825Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509PyPI · tweepy · fixed in 2.3.1, 3.0
- CVE-2012-4406OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadataPyPI · swift · fixed in 1.7.0
- CVE-2012-4456The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validatPyPI · keystone · fixed in 2012.1.2
- CVE-2012-4457OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, whicPyPI · keystone · fixed in 8.0.0a0
- CVE-2012-4413OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to PyPI · keystone · fixed in 2012.1.3
- CVE-2012-3458Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portPyPI · beaker · fixed in 1.6.4, 1.6.5.post1
- CVE-2012-4404security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "KnoPyPI · moin · fixed in 1.9.5
- CVE-2012-3540Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect usersPyPI · horizon