Malicious code in python-aliyun-sdk-kms (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 53bdcdc5414f25435cd821a9217982c4b486c91100caa324a9c3613d4ccd8d42 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-1452 Malicious code in syns-knox-xss-allwhere (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3c6b6e1a22a56620b309d722c59897f1e6d2225c56e8faafc1b87beefc26750 The OpenSSF Package Analysis project identified 'syns-knox-xss-allwhere' @ 1.0.0 pypi as malicious. It is considered malicious because: - The...

MAL-2023-1448 Malicious code in bobikssf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1de7038e3065022e6f037bf1f47954a55f4752e0ebed75979cb78f31568b7d16 The OpenSSF Package Analysis project identified 'bobikssf' @ 0.4 pypi as malicious. It is considered malicious because: - The package communicat...

MAL-2023-8368 Malicious code in python-cos-sdk-v5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9d23946b30370561c42df798c468626c8ec508cdf6f0fc22cc34bb67f2fa187e Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-8364 Malicious code in python-aliyun-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 63f6387d6bfe7ae582be4478cf6a42a8104b44ea50b22489f5217ba2bfb3ce39 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-1435 Malicious code in notsogood (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b089f6e53ae82855fbdcf8b69573b5835bdc0ca9a476056a3fb78f1e85c2a50c The OpenSSF Package Analysis project identified 'notsogood' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8365 Malicious code in python-aliyun-sdk-ecs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fcb822b0528f2cbde54bd2197ed8c774dda8cafc7c3e9ae5aff56465e7c6c72c Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

VMCONNECT: Malicious PyPI Package Mimicking Common Python Tools

By Deeba Ahmed Threat researchers at ReversingLabs, a software supply chain security and malware analysis platform, have discovered a malicious new PyPI… This is a post from HackRead.com Read the original post: VMCONNECT: Malicious PyPI Package Mimicking Common Python Tools...

pyca/cryptography's wheels include vulnerable OpenSSL

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt,...

MAL-2023-8584 Malicious code in pypiele (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ee88c93851e948d712a89564bfc344ce19843d9b5ed8fcd696d5d530fdc59e34 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. The library does not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption, resulting in denial of service conditions...

MAL-2023-1354 Malicious code in barcodegeneratorqr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5de1d1e2140e353329354c268f3866da72c3edffdf57c0bae8c64c285b120a4c The OpenSSF Package Analysis project identified 'barcodegeneratorqr' @ 1.0.3 pypi as malicious. It is considered malicious because: - The packag...

MAL-2023-1407 Malicious code in servantcord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a573def8d25965b25ab7e80b187bc35973c3015d0a23b2c0f8298d800d97a1a2 The OpenSSF Package Analysis project identified 'servantcord' @ 1.0.2 pypi as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to PyPI cryptography package security bypass and denial of service vulnerabilities( ( CVE-2023-23931, CVE-2023-0286 )

Summary Potential PyPI cryptography package security bypass and denial of service vulnerabilities CVE-2023-23931, CVE-2023-0286 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details...

SUSE CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

pipreqs vulnerable to Dependency Confusion

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

Type confusion

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...