Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2007-6738pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackPyPI · pyftpdlib · fixed in 0.1.1
- CVE-2007-6739FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.PyPI · pyftpdlib · fixed in 0.2.0
- CVE-2007-6740The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which mPyPI · pyftpdlib · fixed in 0.2.0
- CVE-2007-6741The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP aPyPI · pyftpdlib · fixed in 0.2.0
- CVE-2008-7262Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary PyPI · pyftpdlib · fixed in 0.3.0
- CVE-2008-7263ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remotPyPI · pyftpdlib · fixed in 0.5.0
- CVE-2008-7264The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descripPyPI · pyftpdlib · fixed in 0.5.0
- CVE-2009-5010Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemoPyPI · pyftpdlib · fixed in 0.5.1
- CVE-2009-5011Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemoPyPI · pyftpdlib · fixed in 0.5.2
- CVE-2009-5012ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to byPyPI · pyftpdlib · fixed in 0.5.2
- CVE-2009-5013Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of sePyPI · pyftpdlib · fixed in 0.5.2
- CVE-2010-3494Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemoPyPI · pyftpdlib · fixed in 0.5.2
- CVE-2010-3495Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daPyPI · zodb3 · fixed in 3.10.0a1, 3.10.0a2
- CVE-2010-2491Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script orPyPI · roundup · fixed in 1.4.14
- CVE-2010-3082Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a cPyPI · django · fixed in 1.2.2
- CVE-2010-3198ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threadsPyPI · zope · fixed in 2.10.12, 2.11.7
- CVE-2010-2487Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote aPyPI · moin · fixed in 1.8.8, 1.9.3
- CVE-2010-2969Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject PyPI · moin · fixed in 1.9.3
- CVE-2010-2970Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or PyPI · moin · fixed in 1.9.3
- CVE-2009-4924Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conducPyPI · python-cjson · fixed in 1.1.0
- CVE-2010-1666Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of serPyPI · python-cjson · fixed in 1.0.5.1, 1.1.0
- CVE-2010-2480Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes itPyPI · mako · fixed in 0.3.4
- CVE-2010-2422Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inPyPI · plone · fixed in 3.3.6, 3.3.5
- CVE-2010-0828Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticPyPI · moin · fixed in 1.9.3, 1.8.8
- CVE-2009-4762MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchicPyPI · moin · fixed in 1.7.3, 1.8.3
- CVE-2010-1104Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and PyPI · zope2 · fixed in 2.8.12, 2.9.12, 2.10.11 and more
- CVE-2010-0667MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environmentPyPI · moin · fixed in 1.9.1
- CVE-2010-0668Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors,PyPI · moin · fixed in 1.8.7, 1.9.2
- CVE-2010-0669MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.PyPI · moin · fixed in 1.8.7, 1.9.2
- CVE-2010-0717The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has uPyPI · moin · fixed in 1.8.7