pyca/cryptography's wheels include vulnerable OpenSSL

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt,...

MAL-2023-8584 Malicious code in pypiele (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ee88c93851e948d712a89564bfc344ce19843d9b5ed8fcd696d5d530fdc59e34 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. The library does not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption, resulting in denial of service conditions...

MAL-2023-1354 Malicious code in barcodegeneratorqr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5de1d1e2140e353329354c268f3866da72c3edffdf57c0bae8c64c285b120a4c The OpenSSF Package Analysis project identified 'barcodegeneratorqr' @ 1.0.3 pypi as malicious. It is considered malicious because: - The packag...

MAL-2023-1407 Malicious code in servantcord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a573def8d25965b25ab7e80b187bc35973c3015d0a23b2c0f8298d800d97a1a2 The OpenSSF Package Analysis project identified 'servantcord' @ 1.0.2 pypi as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to PyPI cryptography package security bypass and denial of service vulnerabilities( ( CVE-2023-23931, CVE-2023-0286 )

Summary Potential PyPI cryptography package security bypass and denial of service vulnerabilities CVE-2023-23931, CVE-2023-0286 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details...

SUSE CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

pipreqs vulnerable to Dependency Confusion

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

Type confusion

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

CVE-2023-31543

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server...

Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to a remote attacker to bypass security restrictions (CVE-2023-23931)

Summary PyPI cryptography package is used in IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the reported vulnerability. Vulnerability Details CVEID:CVE-2023-23931 DESCRIPTION: PyPI cryptography package could allow a remote...

MAL-2023-1355 Malicious code in barcodeqrgen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e27682d3c0d71a71640f7d7830be4cd2125402e0509403333eb45413256f63c The OpenSSF Package Analysis project identified 'barcodeqrgen' @ 1.0.3 pypi as malicious. It is considered malicious because: - The package...

Security Bulletin: Vulnerabilities in cURL libcurl, PostgreSQL, PyPI cryptography, Node.js can affect IBM Spectrum Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in cURL libcurl, PostgreSQL, PyPI cryptography, and Node.js. Vulnerabilities include obtaining sensitive information, causing a denial of service condition, and bypassing security restrictions, as described by the CVEs in the...

MAL-2023-8357 Malicious code in arangodba (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8a8f8299dc6c21b2441da8a56c195b046c05f65c0ab9b78f08aff27eb1611ac7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-1361 Malicious code in dependency1338 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4342f154d7ceb9727add670c55348d65e1b2c18232cbf166d82257971ad05712 The OpenSSF Package Analysis project identified 'dependency1338' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities (CVE-2023-0286, CVE-2023-23931)

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

MAL-2023-8565 Malicious code in gogogolokl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7b050604c15bfdf4e456841a2cbccfb6f6122137aedf82ceae488c2871dfea27 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...