jwtXploiter - A Tool To Test Security Of Json Web Token

A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs; Tamper with the token payload: changes claims and subclaims values. Exploit known vulnerable header claims kid, jku, x5u Verify a token Retrieve the public key of your target's ssl connection and try to use it in a key...

OESA-2021-1284 python-pip security update

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. Security Fixes: A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a...

Updated python3 packages fix security vulnerabilities

Update python3 to 3.8.11 to fix several security issues. Fixes in 3.8.10 are also included. Bundled pip and setuptools were updated in 3.8.11 so python-pip needs to be updated to 21.1.3 and python-setuptools to 56.2.0 at the same time. Also, we fix the following issue: In Python before 3.9.5, the...

Updated python-pip packages fix security vulnerabilities

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository CVE-2021-3572. The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for...

MGASA-2021-0371 Updated python-pip packages fix security vulnerabilities

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository CVE-2021-3572. The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for...

SUSE-SU-2021:2441-1 Security update for python-pip

This update for python-pip fixes the following issues: - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references bsc1186819...

Python pip Path Traversal

The vulnerability of the Python programming language’s pip module is related to shortcomings in pathname restrictions when specifying software for installation via URLs. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

Pip input validation vulnerability

Pip is a set of tools for installing and managing Python packages. An input validation error vulnerability exists in python pip, which could be exploited by a remote attacker to install a different revision on the repository...

SUSE-SU-2021:2304-1 Security update for python-pip

This update for python-pip fixes the following issues: - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references bsc1186819...

Android Apps in Google Play Harvest Facebook Credentials

A set of nine malicious Android apps that steal Facebook credentials were found on Google Play, which racked up a collective 5.9 million installations before Google removed them. According to Dr. Web’s malware analysts, the applications were fully functional, so that victims remained in the dark...

OpenAttack - An Open-Source Package For Textual Adversarial Attack

OpenAttack is an open-source Python-based textual adversarial attack toolkit, which handles the whole process of textual adversarial attacking, including preprocessing text, accessing the victim model, generating adversarial examples and evaluation. Features & Uses OpenAttack has following...

SUSE-FU-2021:2130-1 Feature implementation for python39-pip, python39-setuptools

This update for python39-pip, python39-setuptools fixes the following issues: Changes in python39-setuptools: - Provide python39-setuptools version 44.1.1 with vendored dependencies. jscSLE-17532, jscSLE-17957 Changes in python39-pip: - Provide python39-pip version 20.2.4 with vendored...

Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Path Traversal in pip

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py. ...

oriole-test (0.2.2) potentially affected by CVE-2019-20916 via pip (9.0.2)

pip PYPI version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - oriole-test 0.2.2 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2019-20916 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

magellan (1.0.0b0), sprinter (1.4.1) potentially affected by CVE-2019-20916 via pip (6.1.1)

pip PYPI version 6.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - magellan 1.0.0b0 - sprinter 1.4.1 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

backlogprocessing (>=0.0.0, <=0.0.2), commit-helper (>=3.4.15, <=3.4.16) +17 more potentially affected by CVE-2019-20916 via pip (>=19.0.2, <=19.1.1)

pip PYPI version =19.0.2, =0.0.0, =3.4.15, =2.3.0.18070322, =2.3.0.18072813, =2.3.0.18073020, =0.0.37, =2.3.7.19022609, =2.3.4.19022609, =2.3.2.19022615, =2.3.0.18070322, =0.1.7, =1.4.0, =1.4.4, =2019.2.25, =2019.7.21 and more Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2019-20916 via pip (9.0.1)

pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2019-20916 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...