MAL-2023-1421 Malicious code in tucan-x (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 69bdf61be1b4579f5016adcacef468a263b798b77b87d354e90900d4cb4474b8 The OpenSSF Package Analysis project identified 'tucan-x' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...

GHSA-WP72-7HJ9-5265 Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...

mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

A malicious Python package on the Python Package Index PyPI repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware. The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and...

Security Bulletin: Vulnerability in PyPI cryptography and Python may affect IBM Spectrum Protect Plus File Systems Agent (CVE-2023-23931, CVE-2023-0286, CVE-2023-24329)

Summary IBM Spectrum Protect Plus File Systems Agent can be affected by vulnerability in PyPI cryptography and Python. Vulnerabilities could allow a remote attacker to bypass security restrictions or do a denial of service attack, as described by the CVEs in the "Vulnerability Details" section...

MAL-2023-5898 Malicious code in rawrequest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b9c75bf32c6679c49b3a17ee9ce320dfb26411c4fb2a7cf0fa4f06ceea5ae033 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2934 Malicious code in esqguiproofad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2038f714e65a7ca4986eb7682c8618bbe9cef3aa2ae698dfb2a8321669c84b29 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6974 Malicious code in tpcraftcraftencode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d51287043143cc2b77dac9f3dac8fe7c54c6e797cee2425b1a581c4565357235 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6777 Malicious code in selfvisapaypalmine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3a524c8256175ba1602631d62ca2c164baceef5887f1703949ab0176bb3b458d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6320 Malicious code in selfmccontrolstudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d03dd732353d8a4b704ceabee4dac2c38a0adcb3b1f0dd06041b97a2199dd0fe EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2760 Malicious code in esqccpongcpu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c15d17f192fef96f3398bc91fe19bdcbcca1aa284532b9c0db068eefc1160732 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5033 Malicious code in py-controlpingcraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c99058f83d5f7d5e4269c4fa6066cc572cac0bca48b23b4d296b84a9b658bdd EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4035 Malicious code in libguigrandmc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6aecdbe6b089ffe59ba97add73503b78ab4c6dc432a5b733ed03687c146effbf EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2770 Malicious code in esqccstringmask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ad3667ef6b7620604468e627b774f2339b75086dc8eb705cbaaa95acd784e178 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6982 Malicious code in tpcvadlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d758227301a575ffb8843cdccd4734a806e1bfdee3cc21fbe9e54839748acdbc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4046 Malicious code in libguireplaceram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cbbea9652c38c8cd9deb9c7b785c144b58d88c893c24c59a0a97dc0c10f7978c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6033 Malicious code in selfedgamestudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c130221eaf03a61a98af0a0a5d361a3d0e2b43e20b9dfe8b746999505f986329 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5343 Malicious code in py-mcultracraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 05f872d3d839e83f4cfa6a29e16e93759396a58f0bb74d8f93ec8f14420b0a40 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4315 Malicious code in libpingreintel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 905aa24883834e7a2283436c5d1bfa4a55a49714f4912738ee4c1e38ec413eed EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...