13393 matches found
Directory traversal
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...
Open redirect vulnerability in Flask-Security-Too
An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if...
CVE-2023-49438
An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...
CVE-2023-49438
Vulnerability summary (CVE-2023-49438) : The Python package Flask-Security-Too
Malicious code in vibrant (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaa7491953b666535f724cc8b060802509b09ef8e13b4f3c5ebaa6a0554e4c17 The OpenSSF Package Analysis project identified 'vibrant' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package...
Malicious code in richcolor (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 50d5904bd379a75fd43115d7339df3d79f87ec691026774160b15b8632a9f8ae Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...
Malicious code in excaliburx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1d763da65172935a20c3b03c65deff16a2eb251d857d1fc34e4cc67b72f7610a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...
Malicious code in enchantv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f578b605e73b68aae8c1d8a9bd3f55b810839b2bccd720bccc7f887c2e0046c8 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...
Malicious code in newpackagetest2026 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7b2facdf5925f09b064136d0c919a80e0e83d0a13b4b6f9d903162352c586dc9 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...
CVE-2023-51449
CVE-2023-51449 affects Gradio prior to 4.11.0 via a path traversal/LFI in the /file route. Nuclei templates and CVE records confirm that unauthenticated access to arbitrary server files is possible when authentication is not enabled, potentially exposing sensitive files (e.g., config.json) on Gra...
CVE-2023-51449 Make the `/file` secure against file traversal attacks
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...
CVE-2023-51449 Make the `/file` secure against file traversal attacks
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...
CVE-2023-51449 Make the `/file` secure against file traversal attacks
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...
Malicious code in yelp-cgeom1 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1d368f32894c442f86028103800df96e8818dd226ac82b14b5cec80a267a202 The OpenSSF Package Analysis project identified 'yelp-cgeom1' @ 0.1 pypi as malicious. It is considered malicious because: - The package...
Malicious code in discomusic (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5ae86bb92ecda0b9d67bf6bcb933e00f57e91de9916d1b3a3ad5a68993c0778 The OpenSSF Package Analysis project identified 'discomusic' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package...
27 Malicious PyPI Packages with Thousands of Downloads Found Targeting IT Experts
An unknown threat actor has been observed publishing typosquat packages to the Python Package Index PyPI repository for nearly six months with an aim to deliver malware capable of gaining persistence, stealing sensitive data, and accessing cryptocurrency wallets for financial gain. The 27 package...
python: urllib.parse url blocklisting bypass
A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity...
Moderate: Red Hat Security Advisory: python-pip security update
An update for python-pip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Moderate: Red Hat Security Advisory: python3.11-pip security update
An update for python3.11-pip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
Moderate: python3.11-pip security update
pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python". Security Fixes: python: tarfile...