CVE-2022-41908

TensorFlow is an open source platform for machine learning. An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also...

py-WsgiDAV -- XSS vulnerability

Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting XSS attacks...

hiredis, hiredis-py: Multiple Vulnerabilities

Background hiredis is a minimalistic C client library for the Redis database. hiredis-py is a Python extension that wraps hiredis. Description Hiredis is vulnerable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk array-like...

GLSA-202210-32 : hiredis, hiredis-py: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-32 hiredis, hiredis-py: Multiple Vulnerabilities - Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupt...

ayugespidertools (>=3.4.1 <=3.9.5), baotool (=1.0.1) +128 more potentially affected by CVE-2022-39348 via twisted (>=16.0.0 <=22.10.0)

twisted PYPI version =16.0.0, =3.4.1, =1.5.0, =0.2.0, =0.0.2, =3.9.2, =0.3.4, =0.1.0, =18.4.0, =1.1.2.post3, =3.1.0, =3.2.3 and more Source cves: CVE-2022-39348 Source advisory: OSV:GHSA-VG46-2RRJ-3647...

Withdrawn Advisory: ReDoS in py library when used with subversion

Withdrawn Advisory This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references. Original Description The py library through 1.11.0 for Python allows remote attackers to condu...

Code injection

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled...

PT-2022-26687

Name of the Vulnerable Software and Affected Versions py versions through 1.11.0 Description The py library allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled...

CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

CVE-2022-42969

CVE-2022-42969 affects the Python package py (through 1.11.0). The vulnerability allows a remote ReDoS via a crafted InfoSvnCommand argument in a Subversion repository, caused by mishandling of the info data, per connected IBM security bulletin. The description notes that this issue has been disp...

agixt (>=1.4.20 <=1.4.42), agxclick (>=0.1.36 <=0.4.1) +214 more potentially affected by CVE-2022-1941 via protobuf (>=4.0.0rc2 <=4.21.5)

protobuf PYPI version =4.0.0rc2, =1.4.20, =0.1.36, =0.9.1, =0.0.12, =0.4.0, =1.0.10, =1.0.0b1, =0.1.0, =0.1.2, =0.0.12, =0.2.6, =0.0.20, =0.8.0, =0.12.0 and more Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +103 more potentially affected by CVE-2022-36002 via tensorflow-cpu (>=1.15.0 <=2.7.0)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.1.0.dev1, =0.1.0.dev202107081840 and more Source cves: CVE-2022-36002 Source advisory: OSV:GHSA-MH3M-62V7-68XG...

Security Bulletin: IBM Security QRadar Network Threat Analytics uses component Python Py with denial of service vulnerability (CVE-2020-29651)

Summary This product includes vulnabilities that can be exploited crafting input in the UI per the CVE. The fix updates the component to address the vulnerability. Vulnerability Details CVEID:CVE-2020-29651 DESCRIPTION: Python Py is vulnerable to a denial of service, caused by a regular expressio...

exotel-py includes code execution backdoor inserted by a third party

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. Users should downgrade to version 0.1.5 to avoid the problem...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

The exotel aka exotel-py package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party...

CVE-2022-38792

CVE-2022-38792 : The exotel (exotel-py) package on PyPI up to version 0.1.6 includes a code execution backdoor inserted by a third party. Exploitation details are not provided in the available documents. A remediation is to downgrade to version 0.1.5. The vulnerability has a high impact score (CV...