Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2008-2302Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.PyPI · django · fixed in 0.91.2, 0.95.3, 0.96.2 and more
- CVE-2008-1937The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage usPyPI · moin · fixed in 1.6.3, 1.7.1
- CVE-2008-1474Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-sPyPI · roundup · fixed in 1.4.4
- CVE-2008-1475The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restPyPI · roundup · fixed in 1.4.5
- CVE-2008-0164Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accountsPyPI · plone · fixed in 3.1
- CVE-2008-1393Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the adminPyPI · plone · fixed in 3.0
- CVE-2008-1394Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easierPyPI · plone · fixed in 3.0
- CVE-2008-1396Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, PyPI · plone
- CVE-2008-1098Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HPyPI · moin
- CVE-2008-1099_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected PyPI · moin
- CVE-2008-0780Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary PyPI · moin · fixed in 1.6.1
- CVE-2008-0781Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject aPyPI · moin
- CVE-2008-0782Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a ..PyPI · moin
- CVE-2008-0299common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session PyPI · paramiko · fixed in 1.7.2, 1.7.1-3
- CVE-2008-0252Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilPyPI · cherrypy · fixed in 2.1.1, 3.0.2
- CVE-2007-5741Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled oPyPI · plone · fixed in 2.5.5, 3.0.3
- CVE-2007-5712The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USPyPI · django · fixed in 0.96.1, 0.95.2, 0.91.1 and more
- CVE-2007-5201The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users tPyPI · duplicity · fixed in 0.4.9
- CVE-2007-2637MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via PyPI · moin · fixed in 1.5.8
- CVE-2007-1405Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet ExplorPyPI · trac · fixed in 0.10.3.1
- CVE-2007-1406Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknPyPI · trac · fixed in 0.10.3.1
- CVE-2007-0901Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script orPyPI · moin · fixed in 1.5.8
- CVE-2007-0902Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive informatPyPI · moin · fixed in 1.5.8
- CVE-2007-0857Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML vPyPI · moin · fixed in 1.5.7
- CVE-2007-0404bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, whPyPI · django · fixed in 1.0
- CVE-2007-0405The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remotPyPI · django · fixed in 1.0
- CVE-2006-4249Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masqueraPyPI · plone · fixed in 2.5.2
- CVE-2006-5878Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions asPyPI · trac · fixed in 0.10.1, 0.11
- CVE-2006-4247Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the pasPyPI · plone · fixed in 2.5.1
- CVE-2006-4684The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (rePyPI · zope2 · fixed in 2.8.9