Malicious code in kinto-slack (PyPI)

Source: kam193 0e0434bc9a31ed977738596bc7326ddbc16d225b80d4e219865cb6ec39ff2d78 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

kinto-dist (>=0.7.0, <=0.8.2) potentially affected by CVE-2024-1314 via kinto-attachment (0.8.0)

kinto-attachment PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =0.7.0, =0.8.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.0.0, <=1.11.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.0.1)

kinto-attachment PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.0.0, =1.11.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.12.0, <=1.13.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.1.2)

kinto-attachment PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.12.0, =1.13.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (4.5.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.0.1)

kinto-attachment PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist 4.5.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=2.0.0, <=6.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.1.0)

kinto-attachment PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =2.0.0, =6.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=7.0.0, <=7.3.1) potentially affected by CVE-2024-1314 via kinto-attachment (3.0.1)

kinto-attachment PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =7.0.0, =7.3.1 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=17.4.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=6.0.1, <=6.0.2)

kinto-attachment PYPI version =6.0.1, =17.4.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

PYSEC-2026-1494 Kinto Attachment's attachments can be replaced on read-only records

Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket. And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request...

Kinto Attachment's attachments can be replaced on read-only records

ImpactThe attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket.And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous...

MAL-2026-5815 Malicious code in kinto-slack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e0434bc9a31ed977738596bc7326ddbc16d225b80d4e219865cb6ec39ff2d78 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in kinto-slack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e0434bc9a31ed977738596bc7326ddbc16d225b80d4e219865cb6ec39ff2d78 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

kinto-dist (>=0.7.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=0.8.0, <=6.0.2)

kinto-attachment PYPI version =0.8.0, =0.7.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: MEND:CVE-2024-1314...

kinto (>=1.4.0, <=1.9.0), syncto (1.5.0) potentially affected by CVE-2024-49769 via waitress (0.8.10)

waitress PYPI version 0.8.10 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - kinto =1.4.0, =1.9.0 - syncto 1.5.0 Source cves: CVE-2024-49769 Source advisory: OSV:PYSEC-2024-211...

kinto-dist (>=17.4.0, <=17.5.2), metlinkpid-http (1.0.0) +1 more potentially affected by CVE-2024-49769 via waitress (1.3.1)

waitress PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - kinto-dist =17.4.0, =17.5.2 - metlinkpid-http 1.0.0 - toggl2pl 1.0.4 Source cves: CVE-2024-49769 Source advisory: OSV:PYSEC-2024-211...

chellow (>=2234.0.0, <=2243.0.0), kinto-dist (18.0.2) potentially affected by CVE-2024-49769 via waitress (1.4.2)

waitress PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - chellow =2234.0.0, =2243.0.0 - kinto-dist 18.0.2 Source cves: CVE-2024-49769 Source advisory: OSV:PYSEC-2024-211...

kinto (>=1.4.0, <=1.9.0), syncto (1.5.0) potentially affected by CVE-2024-49769 via waitress (0.8.10)

waitress PYPI version 0.8.10 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - kinto =1.4.0, =1.9.0 - syncto 1.5.0 Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

kinto-dist (>=17.4.0, <=17.5.2), metlinkpid-http (1.0.0) +1 more potentially affected by CVE-2024-49769 via waitress (1.3.1)

waitress PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - kinto-dist =17.4.0, =17.5.2 - metlinkpid-http 1.0.0 - toggl2pl 1.0.4 Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

chellow (>=2234.0.0, <=2243.0.0), kinto-dist (18.0.2) potentially affected by CVE-2024-49769 via waitress (1.4.2)

waitress PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - chellow =2234.0.0, =2243.0.0 - kinto-dist 18.0.2 Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

Improper Access Control

Kinto Attachment is vulnerable to Improper Access Control. The vulnerability is due to improper access control where the attachment file of an existing record can be replaced if the user has "read" permission on one of the parent...