Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2009-4405Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks inPyPI · trac · fixed in 0.11.6
- CVE-2009-2940The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers tPyPI · pygresql · fixed in 4.1
- CVE-2009-3695Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause aPyPI · django · fixed in 1.0.4, 1.1.1
- CVE-2009-2701Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 PyPI · zodb3 · fixed in 3.8.3, 3.9.0c2
- CVE-2009-2967Multiple cross-site scripting (XSS) vulnerabilities in Buildbot 0.7.6 through 0.7.11p2 allow remote attackers to inject arbitrary web scriptPyPI · buildbot · fixed in 0.7.12, 0.7.11p3
- CVE-2009-2959Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allowPyPI · buildbot · fixed in 0.7.12, 0.7.11p3
- CVE-2008-6954The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by ediPyPI · cobbler · fixed in 1.2.9
- CVE-2009-2737The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly cPyPI · roundup · fixed in 1.2.1, 1.4.7
- CVE-2009-0668Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enablePyPI · zodb3 · fixed in 3.8.2
- CVE-2009-0669Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers toPyPI · zodb3 · fixed in 3.8.2
- CVE-2009-2659The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media filePyPI · django · fixed in 0.96.4, 1.0.3, 1.1
- CVE-2009-1482Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject aPyPI · moin · fixed in 1.8.3
- CVE-2009-0662The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remotPyPI · plone, products-plonepas · fixed in 3.9
- CVE-2008-6603MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypassPyPI · moin · fixed in 1.6.3, 1.7.1
- CVE-2008-6547schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass iPyPI · formencode · fixed in 1.0.1
- CVE-2008-6548The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorizePyPI · moin · fixed in 1.6.2
- CVE-2008-6549The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are noPyPI · moin · fixed in 1.6.1
- CVE-2009-0397Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) PyPI · gstreamer-plugins
- CVE-2009-0386Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) PyPI · gstreamer-plugins
- CVE-2009-0387Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 thPyPI · gstreamer-plugins
- CVE-2009-0312Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers toPyPI · moin · fixed in 1.8.2
- CVE-2009-0260Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrPyPI · moin · fixed in 1.8.1
- CVE-2008-5646Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certainPyPI · trac · fixed in 0.11.2
- CVE-2008-5647Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attackPyPI · trac · fixed in 0.11.2
- CVE-2008-4571Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web scriPyPI · plone · fixed in 3.0.4
- CVE-2008-3909The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful PyPI · django · fixed in 0.91.3, 0.95.4, 0.96.3 and more
- CVE-2008-3381Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackersPyPI · moin · fixed in 1.6.4, 1.7.1
- CVE-2008-2951Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and PyPI · trac · fixed in 0.10.5
- CVE-2008-3328Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or PyPI · trac · fixed in 0.10.5
- CVE-2008-2942Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot)PyPI · mercurial · fixed in 1.0.2