AZL-35444 CVE-2023-43804 affecting package python-urllib3 for versions less than 2.0.7-1

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

Malicious code in nvkvictim-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d0c415815934e3c66b707f8613100479590a1afe4a29fc46c607999157536e2 The OpenSSF Package Analysis project identified 'nvkvictim-poc' @ 0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in pyhulul (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f22a13d592f8a4de9eaf39b1c4c0c149232890e90dc5cff2988d49901d31a3e2 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in pyjio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 26d9b6377460b59c1e31da04bf9acd401bd082c4911c43dbe41a60d55d65904a Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in pyalsogkert (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx db76c02045b01626113fc566fbbcd5f7fd5ccbd230e7e5c6dc0ed090a712c9b1 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in kokokoako (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 037e7b78b81b8740ce2627e91bec2d913cb5ef310bf3d7a80046fee57dd42162 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in pytasler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9209d9bf3f5a8205e05d9cb3e590cb8ad8cdf90cedb528dd047828c38b308361 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

SUSE: Security Advisory (SUSE-SU-2023:3730-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in pyhjdddo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ac1a1233d8897ffaa72bc15d95e9f16517f66801df9f3eee30f97a8dc675d7bf Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in pytarlooko (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6dddca319cc76ce2f8951f40c21b31bf4a25775212cc5339063154c7aecf052f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in pystallerer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b5a51d76ce9c25a9173b53083249e289f894f767751f075d7d9bf112d946a7ee Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in telethon2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2f513e1bd0172cda035284efad9368870bc46158926c112ccd7fc881e6af75be Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

HDFS Apache Airflow HDFS Provider Arbitrary Package Loading

The vulnerability of the network-based software for automating data processing tasks in HDFS and Apache Airflow’s HDFS Provider is related to the inclusion of functions from an unverified controlled area during the processing of PyPI package names. Exploiting this vulnerability allows a malicious...

Malicious code in alibabacloud-vpc20180317 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0c24b33d1db8fffd5daaf1985d25add4bc66e7879e1a6efbc7ae706816931834 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Malicious code in alibabacloud-ecs20180317 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8af47576c10df6b4eb3fae145ce469e9ef394691bde6181e0fef25dbc8358f7a Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Developers Beware: Malicious Rust Libraries Caught Transmitting OS Info to Telegram Channel

In yet another sign that developers continue to be targets of software supply chain attacks, a number of malicious packages have been discovered on the Rust programming language's crate registry. The libraries, uploaded between August 14 and 16, 2023, were published by a user named "amaperf,"...

Malicious code in pyghoster (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5dff2bd9da92b93b22c32e611a7d510147596aa9a8e0f566cb9e5b25dc8a45d3 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

RHEL 7 : python (RHSA-2023:3555)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3555 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Malicious code in aliyun-oss2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c33f6b28da216b43120a3b8a8537d0263dc1eb2b22979a4183b371ff57b9e0b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Malicious code in syns-knox-xss-allwhere (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3c6b6e1a22a56620b309d722c59897f1e6d2225c56e8faafc1b87beefc26750 The OpenSSF Package Analysis project identified 'syns-knox-xss-allwhere' @ 1.0.0 pypi as malicious. It is considered malicious because: - The...