Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2006-3695Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) PyPI · trac · fixed in 0.9.6
- CVE-2006-3458Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restrPyPI · zope2 · fixed in 2.7.8, 2.8.7, 2.9.3
- CVE-2006-2458Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_reaPyPI · extractor
- CVE-2006-1711Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPPyPI · plone · fixed in 2.0.6
- CVE-2006-0847Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files viaPyPI · cherrypy · fixed in 2.1.1
- CVE-2005-4644Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web scPyPI · trac · fixed in 0.9-stable, 0.10
- CVE-2005-2875Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.PyPI · py2play
- CVE-2005-1632Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local userPyPI · cheetah
- CVE-2004-1444Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via ..PyPI · roundup · fixed in 0.7.3
- CVE-2004-1462Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (PyPI · moin · fixed in 1.2.3
- CVE-2004-1463Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.PyPI · moin · fixed in 1.2.3
- CVE-2004-1177Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web scriptPyPI · mailman · fixed in 2.1.5
- CVE-2004-0708MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has hiPyPI · moin · fixed in 1.2.2
- CVE-2004-0412Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.PyPI · mailman · fixed in 2.1.5
- CVE-2000-1211Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objectsPyPI · zope
- CVE-2000-1212Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editinPyPI · zope
- CVE-2002-0170Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents PyPI · zope · fixed in 2.4.4, 2.5.1
- CVE-2002-0687The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.PyPI · zope · fixed in 2.4.4b2, 2.5.1b2
- CVE-2002-0688ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictioPyPI · zope · fixed in 2.6.0
- CVE-2003-0038Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via tPyPI · mailman · fixed in 2.1.1
- CVE-2000-0483The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.PyPI · zope
- CVE-2000-0725Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by mPyPI · zope · fixed in 2.2.1
- CVE-2000-0062The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.PyPI · zope