Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2011-4138The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validiPyPI · django · fixed in 1.2.7, 1.3.1
- CVE-2011-4139Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows PyPI · django · fixed in 1.2.7, 1.3.1
- CVE-2011-4140The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting PyPI · django · fixed in 1.2.7, 1.3.1
- CVE-2011-3587Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackePyPI · zope2 · fixed in 2.12.20, 2.13.10
- CVE-2011-4030The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from beinPyPI · plone · fixed in 4.0.10, 4.1.1, 4.2a3
- CVE-2010-4340libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypassPyPI · apache-libcloud · fixed in 0.4.0, 0.4.2
- CVE-2011-1340Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to PyPI · plone · fixed in 2.5.3
- CVE-2011-2185Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other fPyPI · fabric · fixed in 1.1.0
- CVE-2011-2528Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PlonePyPI · plone, zope2 · fixed in 3.3.6, 2.12.19, 2.13.8
- CVE-2011-1948Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a craftPyPI · plone, products-cmfplone +1 · fixed in 4.1.1, 4.0.7, 4.1rc3 and more
- CVE-2011-1949Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authentPyPI · plone · fixed in 3.3.6, 4.0.6, 4.1.1
- CVE-2011-1950plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectorPyPI · plone, plone-app-users · fixed in 4.1.1, 4.0.6, 1.0.5 and more
- CVE-2009-5065Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows rPyPI · feedparser · fixed in 5.0
- CVE-2011-1156feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of serviPyPI · feedparser · fixed in 5.0.1
- CVE-2011-1157Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 alPyPI · feedparser · fixed in 5.0.1
- CVE-2011-1158Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 alPyPI · feedparser · fixed in 5.0.1
- CVE-2011-0728Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbPyPI · loggerhead · fixed in 1.18.1
- CVE-2011-0432Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV beforePyPI · pywebdav · fixed in 0.9.4.1
- CVE-2011-1058Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils PyPI · moin · fixed in 1.9.3
- CVE-2011-0696Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makPyPI · django · fixed in 1.1.4, 1.2.5
- CVE-2011-0697Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrarPyPI · django · fixed in 1.1.4, 1.2.5
- CVE-2011-0698Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or exePyPI · django · fixed in 1.1.4, 1.2.5
- CVE-2011-0720Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain aPyPI · plone · fixed in 4.0.1, 4.0.4
- CVE-2010-4338ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generatedPyPI · ocrodjvu · fixed in 0.4.6-2
- CVE-2010-4534The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properPyPI · django · fixed in 1.1.3, 1.2.4
- CVE-2010-4535The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not valPyPI · django · fixed in 1.1.3, 1.2.4
- CVE-2010-2235template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of thePyPI · cobbler · fixed in 2.0.7
- CVE-2010-2477Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers PyPI · paste · fixed in 1.7.4
- CVE-2007-6736Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary PyPI · pyftpdlib · fixed in 0.2.0
- CVE-2007-6737FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, PyPI · pyftpdlib · fixed in 0.2.0