c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), pycnet-audio (>=0.5.1, <=0.5.8) +2 more potentially affected by CVE-2020-15265 via tensorflow-cpu (>=2.1.0, <=2.3.1)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2020-15265 Source advisory: GHSA-RRFP-J2MP-HQ9C...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

Awesome-Red-Teaming

This is a list of resources for Red Teaming, a list that will be updated regularly with the latest adversarial tactics and techniques based on the Mitre ATT&CK framework. The list covers various topics such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credenti...

FreeBSD : py-matrix-synapse -- XSS vulnerability (5f39d80f-107c-11eb-8b47-641c67a117d8)

Matrix developers reports : The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities,...

py-matrix-synapse -- XSS vulnerability

Matrix developers reports: The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities,...

FreeBSD : py-matrix-synapse -- malformed events may prevent users from joining federated rooms (2327234d-fc4b-11ea-adef-641c67a117d8)

Affected Synapse versions assume that all events have an 'origin' field set. If an event without the 'origin' field is sent into a federated room, servers not already joined to the room will be unable to do so due to failing to fetch the malformed event. Impact : An attacker could cause a denial ...

PT-2020-17233

Name of the Vulnerable Software and Affected Versions py versions through 1.9.0 Description A denial of service via regular expression in the py.path.svnwc component could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

py-Flask-Cors -- directory traversal vulnerability

praetorian-colby-morgan reports: An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

FreeBSD : security/py-ecdsa -- multiple issues (a23ebf36-e8b6-4665-b0f3-4c977f9a145c)

py-ecdsa developers report : Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding. Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Code injection

An unhandled exception in checkignored in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.1...

Fedora 32 : python37 (2020-87c0a0a52d)

Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possib...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-10177 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-10177 Source advisory: OSV:GHSA-CQHG-XJHH-P8HF...

blockies (0.0.1), demosys-py (>=0.1.2, <=0.3.12) +17 more potentially affected by CVE-2020-10994 via pillow (4.0.0)

pillow PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - blockies 0.0.1 - demosys-py =0.1.2, =0.0.2, =1.6.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.0, =3.0.0 and more Source cves:...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-10994 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-10994 Source advisory: OSV:GHSA-VJ42-XQ3R-HR3R...

FreeBSD : py-matrix-synapse -- multiple vulnerabilities (d9f686f3-fde0-48dc-ab0a-01c2fe3e0529)

Matrix developers report : Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild. - A malicious homeserver could force Synapse to reset the state in a room to a small subset o...

bedrock (0.1.0.dev10), dbcollection (>=0.2.2, <=0.2.6) +19 more potentially affected by CVE-2020-10994 via pillow (5.1.0)

pillow PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - bedrock 0.1.0.dev10 - dbcollection =0.2.2, =0.0.6, =1.0.0, =0.0.0a1, =0.1.0, =4.0.0, =4.0.0, =4.0.0, =4.1.1 and more Source cves: CVE-2020-10994...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2020-10177 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2020-10177 Source advisory...

Py-EVM Security Vulnerability

Py-EVM is a Python-based implementation of an Ethernet virtual machine. A security vulnerability exists in Py-EVM version 0.2.0-alpha.33. An attacker can exploit the vulnerability to cause a denial of service...

vogue.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1164061 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

python27:2.7 security, bug fix, and enhancement update

An update is available for python-pymongo, python2-rpm-macros, python-docutils, pytest, python-psycopg2, python-PyMySQL, python-lxml, PyYAML, python-pytest-mock, python-attrs, python-jinja2, python-docs, python-requests, python-mock, python-ipaddress, python-funcsigs, python-py, python-chardet,...