kinto-dist (>=0.7.0, <=0.8.2) potentially affected by CVE-2024-1314 via kinto-attachment (0.8.0)

kinto-attachment PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =0.7.0, =0.8.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=7.0.0, <=7.3.1) potentially affected by CVE-2024-1314 via kinto-attachment (3.0.1)

kinto-attachment PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =7.0.0, =7.3.1 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=17.4.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=6.0.1, <=6.0.2)

kinto-attachment PYPI version =6.0.1, =17.4.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.0.0, <=1.11.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.0.1)

kinto-attachment PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.0.0, =1.11.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.12.0, <=1.13.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.1.2)

kinto-attachment PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.12.0, =1.13.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (4.5.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.0.1)

kinto-attachment PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist 4.5.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=2.0.0, <=6.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.1.0)

kinto-attachment PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =2.0.0, =6.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

PYSEC-2026-1494 Kinto Attachment's attachments can be replaced on read-only records

Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket. And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request...

Kinto Attachment's attachments can be replaced on read-only records

ImpactThe attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket.And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous...

kinto-dist (>=0.7.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=0.8.0, <=6.0.2)

kinto-attachment PYPI version =0.8.0, =0.7.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: MEND:CVE-2024-1314...

Kinto Attachment's attachments can be replaced on read-only records

Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket. And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request...

kinto-dist (>=1.0.0, <=1.11.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.0.1)

kinto-attachment PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.0.0, =1.11.0 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

GHSA-HVP4-VRV2-8WRQ Kinto Attachment's attachments can be replaced on read-only records

Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket. And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request...

kinto-dist (4.5.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.0.1)

kinto-attachment PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist 4.5.2 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=17.4.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=6.0.1, <=6.0.2)

kinto-attachment PYPI version =6.0.1, =17.4.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=1.12.0, <=1.13.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.1.2)

kinto-attachment PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.12.0, =1.13.0 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=7.0.0, <=7.3.1) potentially affected by CVE-2024-1314 via kinto-attachment (3.0.1)

kinto-attachment PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =7.0.0, =7.3.1 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=17.4.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=6.0.1, <=6.0.2)

kinto-attachment PYPI version =6.0.1, =17.4.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=2.0.0, <=6.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.1.0)

kinto-attachment PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =2.0.0, =6.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...

kinto-dist (>=0.7.0, <=0.8.2) potentially affected by CVE-2024-1314 via kinto-attachment (0.8.0)

kinto-attachment PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =0.7.0, =0.8.2 Source cves: CVE-2024-1314 Source advisory: OSV:GHSA-HVP4-VRV2-8WRQ...