Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2012-3542OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary PyPI · keystone · fixed in 2012.1
- CVE-2012-2146Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependentPyPI · elixir
- CVE-2012-1176Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (appPyPI · pyfribidi · fixed in 0.11.0
- CVE-2012-3447virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrPyPI · nova · fixed in 12.0.0
- CVE-2012-1585OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consPyPI · nova · fixed in 12.0.0a0
- CVE-2012-3442The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1PyPI · django · fixed in 1.3.2, 1.4.1
- CVE-2012-3443The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data duringPyPI · django · fixed in 1.3.2, 1.4.1
- CVE-2012-3444The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk siPyPI · django · fixed in 1.3.2, 1.4.1
- CVE-2012-3426OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expirPyPI · keystone · fixed in 8.0.0a0
- CVE-2012-3360Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirtPyPI · nova · fixed in 12.0.0a0
- CVE-2012-3361virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwPyPI · nova · fixed in 12.0.0a0
- CVE-2012-3371The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, alPyPI · nova · fixed in 12.0.0a0
- CVE-2012-0215model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2MaPyPI · trytond · fixed in 2.2.4, 2.4.0
- CVE-2012-2654The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protoPyPI · nova · fixed in 12.0.0a0
- CVE-2012-2417PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature sPyPI · pycrypto · fixed in 2.6
- CVE-2012-2395Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacPyPI · cobbler · fixed in 2.6.0
- CVE-2012-2101Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated usePyPI · nova · fixed in 12.0.0a0
- CVE-2012-0805Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL coPyPI · sqlalchemy · fixed in 0.7.0, 0.7.0b4
- CVE-2012-2094Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack DasPyPI · horizon · fixed in 8.0.0a0
- CVE-2012-2144Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sPyPI · horizon · fixed in 8.0.0a0
- CVE-2012-2374CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to injectPyPI · tornado · fixed in 2.2.1
- CVE-2012-2921Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumPyPI · feedparser · fixed in 5.1.2
- CVE-2012-0878Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attacPyPI · paste, pastescript · fixed in 1.7.5.1, 2.0.1
- CVE-2012-0054libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, aPyPI · golismero
- CVE-2011-4617virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.PyPI · virtualenv · fixed in 1.5
- CVE-2011-4462Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, whiPyPI · plone · fixed in 4.1.4
- CVE-2011-4596Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registrationPyPI · nova · fixed in 12.0.0a0
- CVE-2011-4356Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of thPyPI · celery · fixed in 2.2.8, 2.3.4, 2.4.4
- CVE-2011-4136django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace forPyPI · django · fixed in 1.2.7, 1.3.1
- CVE-2011-4137The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries thatPyPI · django · fixed in 1.2.7, 1.3.1