CentOS 9 : python3.9-3.9.14-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the python3.9-3.9.14-1.el9 build changelog. - In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap...

Malicious code in djanggo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 011da0e2a451e787d1c7b54c29f3090de47bd2366de80983667665a70d885320 The OpenSSF Package Analysis project identified 'djanggo' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

CVE-2024-26151 Potentially untrusted input is rendered as HTML in final output

The mjml PyPI package, found at the FelixSchwarz/mjml-python GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of FelixSchwarz/mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input...

Crypto Stealing PyPI Malware Hits Both Windows and Linux Users

By Deeba Ahmed FortiGuard Labs latest research report reveals a concerning trend: threat actors are leveraging the Python Package Index PyPI,… This is a post from HackRead.com Read the original post: Crypto Stealing PyPI Malware Hits Both Windows and Linux Users...

SUSE CVE-2024-23342

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

UBUNTU-CVE-2024-23342

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2023-3412)

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL...

GHSA-V3RG-QM46-XRG9 Path traversal in flaskcode

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...

CVE-2023-52288

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/.txt URI from views.py, allows attackers to read arbitrary files...

Directory traversal

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...

Open redirect vulnerability in Flask-Security-Too

An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if...

CVE-2023-49438

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...

CVE-2023-49438

Vulnerability summary (CVE-2023-49438) : The Python package Flask-Security-Too

Malicious code in vibrant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaa7491953b666535f724cc8b060802509b09ef8e13b4f3c5ebaa6a0554e4c17 The OpenSSF Package Analysis project identified 'vibrant' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package...

Malicious code in richcolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50d5904bd379a75fd43115d7339df3d79f87ec691026774160b15b8632a9f8ae Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in excaliburx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d763da65172935a20c3b03c65deff16a2eb251d857d1fc34e4cc67b72f7610a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in enchantv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f578b605e73b68aae8c1d8a9bd3f55b810839b2bccd720bccc7f887c2e0046c8 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in newpackagetest2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b2facdf5925f09b064136d0c919a80e0e83d0a13b4b6f9d903162352c586dc9 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

CVE-2023-51449 Make the `/file` secure against file traversal attacks

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

CVE-2023-51449

CVE-2023-51449 affects Gradio prior to 4.11.0 via a path traversal/LFI in the /file route. Nuclei templates and CVE records confirm that unauthenticated access to arbitrary server files is possible when authentication is not enabled, potentially exposing sensitive files (e.g., config.json) on Gra...