1053 matches found
CVE-2025-0938
A flaw was found in Python. The Python standard library functions urllib.parse.urlsplit and urlparse accept domain names that included square brackets, which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs...
DEBIAN-CVE-2025-0938
The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in...
PT-2025-4103
Name of the Vulnerable Software and Affected Versions Python versions prior to 3.11.12 Description The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names containing square brackets, which violates RFC 3986. According to the specification, square brackets...
SUSE CVE-2025-24359
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...
[SECURITY] Fedora 40 Update: mingw-python-jinja2-3.1.5-1.fc40
MinGW Windows Python jinja2 library...
BIT-PYTHON-MIN-2021-29921
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This in some situations allows attackers to bypass access control that is based on IP addresses...
Gradio Detection
An Gradio Python library is installed on the remote host. Note that Nessus has relied upon on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid213710; scriptversion"1.4";...
Medium: python-webob
Issue Overview: WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treat...
PT-2025-49260
Name of the Vulnerable Software and Affected Versions urllib3 versions 1.24 through 2.5.9 Description urllib3 is a user-friendly HTTP client library for Python. In versions starting from 1.24 and prior to 2.6.0, the decompression chain had an unbounded number of links. This allowed a malicious...
AZL-54647 CVE-2024-56326 affecting package python-jinja2 for versions less than 3.0.3-5
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the...
python-libarchive Python Library <= 4.2.1 Directory Traversal (CVE-2024-55587)
The version of the python-libarchive Python library that is installed on the remote host is 4.2.1 or prior. It is, therefore, affected by a directory traversal vulnerability. python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and...
CLSA-2024-1734027948 Update of python
Version was updated...
Pdoc Python Library <= 14.5.1 (CVE-2024-38526)
pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1. Note that Nessus has not tested for this issue but...
EUVD-2024-3441
python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...
PT-2024-36562
Name of the Vulnerable Software and Affected Versions python-libarchive versions 4.2.1 and earlier Description The issue allows directory traversal, enabling the creation of files in extract in zip.py for ZipFile.extractall and ZipFile.extract functions. This can be exploited to create files...
CVE-2024-53865
zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...
Malicious Package
Overview aiocpa is a malicious package. This package contains malicious code steals sensitive information from the victim. Remediation Avoid using all malicious instances of the aiocpa package. References - Phylum Blog Credit: Phylum Research Team...
urllib3: proxy-authorization request header is not stripped during cross-origin redirects
A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...
PYSEC-2024-191
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...