arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2021-25291 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2021-25291 Source advisory: OSV:GHSA-MVG9-XFFR-P774...

chromewhip (>=0.2.2, <=0.2.16), cloud-volume (>=0.6.12, <=0.8.1) +11 more potentially affected by CVE-2021-25290 via pillow (4.2.1)

pillow PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - chromewhip =0.2.2, =0.6.12, =4.4.1, =0.0.1a0, =0.9.0, =0.6.19a0, =0.3.5, =0.0.3, =11.0.0, =11.2.0 Source cves: CVE-2021-25290 Source advisory:...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2021-25290 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2021-25290 Source advisory: OSV:GHSA-8XJQ-8FCG-G5HW...

django-codenerix (1.0.0) potentially affected by CVE-2021-25290 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2021-25290 Source advisory: OSV:GHSA-8XJQ-8FCG-G5HW...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25290 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25290 Source advisory:...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2021-25290 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2021-25290 Source advisory: OSV:GHSA-8XJQ-8FCG-G5HW...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2021-25289 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2021-25289 Source advisory: OSV:GHSA-57H3-9RGR-C24M...

django-codenerix (1.0.0) potentially affected by CVE-2021-25289 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2021-25289 Source advisory: OSV:GHSA-57H3-9RGR-C24M...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2021-25289 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2021-25289 Source advisory: OSV:GHSA-57H3-9RGR-C24M...

CVE-2021-21377

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21376

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...

CVE-2021-21377

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21376

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...

Information disclosure

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...

Input validation

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21377

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21377 Open Redirect in OMERO.web

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21377

Summary: CVE-2021-21377 affects OMERO.web up to version 5.9.0, where redirects after login or group context switch could be sent to untrusted external URLs due to missing URL validation. The vulnerability is mitigated in 5.9.0 by added URL validation; external URLs are rejected unless explicitly ...

CVE-2021-21376

CVE-2021-21376 affects OMERO.web (Django-based web interface for OMERO). The vulnerability arises because before version 5.9.0, the main webclient pages load and expose various information about the current user (e.g., user id, name, and group memberships). Some additional loaded information is n...

CVE-2021-21376 Information Exposure in OMERO.web

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...