AZL-40466 CVE-2024-34069 affecting package python-werkzeug for versions less than 2.3.7-2

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

Malicious code in threadxpools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41a0be6e9aa8db3965bae9f646d47ad6cb85ac9600c8bd71358409062b8fe105 The OpenSSF Package Analysis project identified 'threadxpools' @ 1.2 pypi as malicious. It is considered malicious because: - The package...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Malicious code in reqargs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d1ba9bc54763d8ec8336f0edc8d5997d5fb080801556f288a4935dac06d4878 The OpenSSF Package Analysis project identified 'reqargs' @ 1.4 pypi as malicious. It is considered malicious because: - The package communicate...

python3.11-pip bug fix and enhancement update

An update is available for python3.11-pip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list pip is a package management system used to install and manage software...

Malicious code in sparklog (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa3ac41199a392a32d649e60da4ff9d98d6ceb0d956297d976ce3b5dc948dc91 The OpenSSF Package Analysis project identified 'sparklog' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package executes...

Malicious code in types-for-adobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 927dcbc233169c84ab7ef0e97232782f6bb821d476409cc6ccc8587995dabdc8 The OpenSSF Package Analysis project identified 'types-for-adobe' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...

Malicious code in lyft-exceptions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5e0290aaa0cb90a501cb0a0b357f32d3e725f6f3a97541cbc2796671ea4e8f60 The OpenSSF Package Analysis project identified 'lyft-exceptions' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in lyft-settings (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11c2890ec2321b818585ae36669c7c7b9b8b88d0b0b4c7b47679988a9908c569 The OpenSSF Package Analysis project identified 'lyft-settings' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

PT-2024-22768 · Unknown +1 · Filecachetools +1

Name of the Vulnerable Software and Affected Versions: Rocket.Chat.Audit through 5ad78e8 Description: The issue arises because Rocket.Chat.Audit depends on filecachetools, which is not available in PyPI. This situation may lead to potential security risks due to the missing dependency...

EulerOS 2.0 SP11 : python-pycryptodome (EulerOS-SA-2024-1248)

According to the versions of the python-pycryptodome package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack...

openSUSE: Security Advisory for python (SUSE-SU-2023:3933-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for python (SUSE-SU-2023:3972-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:0168-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for python (openSUSE-SU-2023:0174-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in pyalicet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96a6abcd56ea94e027d0d68089a1b6f29312c009aa9be7d80c4b0e33bf0e6396 The OpenSSF Package Analysis project identified 'pyalicet' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package...

CentOS 9 : python3.9-3.9.14-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the python3.9-3.9.14-1.el9 build changelog. - In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap...

Malicious code in djanggo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 011da0e2a451e787d1c7b54c29f3090de47bd2366de80983667665a70d885320 The OpenSSF Package Analysis project identified 'djanggo' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

CVE-2024-26151 Potentially untrusted input is rendered as HTML in final output

The mjml PyPI package, found at the FelixSchwarz/mjml-python GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of FelixSchwarz/mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input...

Crypto Stealing PyPI Malware Hits Both Windows and Linux Users

By Deeba Ahmed FortiGuard Labs latest research report reveals a concerning trend: threat actors are leveraging the Python Package Index PyPI,… This is a post from HackRead.com Read the original post: Crypto Stealing PyPI Malware Hits Both Windows and Linux Users...