CVE-2014-0472

CVE-2014-0472 使用 docker-compose up -d 访问 localhost:8083 参考： https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. 一个或多个视图存在，根据用户输入构造 URL（通常是一个查询字符串中的“next”参数，指示操作成功完成后的重定向位置）。 2. 一个或多个模块已知攻击者存在于服务器的 Python 导入路径上，这些模块在导入时会执行带有副作用的代码。 在 tests.py 中 def evilfunction: print"exploit successful"...

MAL-2026-6590 Malicious code in envfile-sync-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097a9a647e6d99cd53b881cae4fdd747d03b319388107c946c70b8804d3d917b On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable sha256...

Malicious code in noteparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270d4c797fe34bc0b9598608f45add8721f1fa80d1488e4fae750e3a7b38419e noteparse 1.1.27 ships live MinIO credentials in configReader.py endpoint uicfile.uniview.com, accesskey 'uicpro', secretkey 'uicpropass123' that are...

MAL-2026-3690 Malicious code in dlty (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494f5fbab24a26771e84ce06eea5303b7d1b9135b505a6d93a01c417603f1902 Importing the dlty package triggers an active data-exfiltration channel from the installer to third-party-controlled infrastructure. dlty/init.py...