Lucene search
+L
PypaMost viewed

7327 matches found

PyPA
PyPA
added 2025/01/21 3:15 p.m.15 views

PYSEC-2025-12

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions,including but not...

8.2CVSS7.2AI score0.00252EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2024/12/12 2:02 a.m.15 views

PYSEC-2024-297

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...

8.1CVSS5.8AI score0.00583EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2024/11/28 5:15 p.m.15 views

PYSEC-2024-161

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

9.8CVSS7.7AI score0.02322EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2024/11/08 10:15 p.m.15 views

PYSEC-2024-305

wasm3 139076a contains memory leaks in Readutf8...

8.4CVSS5.8AI score0.00264EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2024/11/06 8:15 p.m.15 views

PYSEC-2024-275

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary file...

6.5CVSS5.9AI score0.00687EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2024/11/06 3:15 p.m.15 views

PYSEC-2024-183

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

8.7CVSS7.1AI score0.00479EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2024/10/24 9:15 p.m.15 views

PYSEC-2024-292

A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files...

5.5CVSS6.2AI score0.00226EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2024/09/25 6:15 p.m.15 views

PYSEC-2024-171

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable ...

8CVSS7AI score0.0023EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2024/08/21 4:15 p.m.15 views

PYSEC-2024-181

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and theuser to click the provid...

6.1CVSS6.5AI score0.0173EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2024/08/18 7:15 p.m.15 views

PYSEC-2024-260

Withdrawn as duplicate of PYSEC-2024-71. A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant...

7.5CVSS6.7AI score0.00718EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2024/06/06 7:16 p.m.15 views

PYSEC-2024-110

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

4.7CVSS6.6AI score0.00189EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2024/06/06 7:15 p.m.15 views

PYSEC-2024-239

A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command 'Command Injection' within the mlflow.data.httpdatasetsource.py module. Specifically, when loading a dataset from a source URL with an HTTP...

10CVSS8.5AI score0.02401EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2024/06/06 7:15 p.m.15 views

PYSEC-2024-105

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of...

3.1CVSS6.7AI score0.00291EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2024/05/01 3:15 a.m.15 views

PYSEC-2024-285

lunasvg v2.3.9 was discovered to contain a segmentation violation via the component compositionsolidsourceover...

9.8CVSS5.7AI score0.00847EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2024/05/01 3:15 a.m.15 views

PYSEC-2024-281

lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp...

7.5CVSS5.8AI score0.00744EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2024/04/25 6:15 p.m.15 views

PYSEC-2024-209

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the sqrt builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the buildIR function of the sqrt builtin doesn't cache the argument to...

5.3CVSS7AI score0.00455EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2024/04/19 8:15 p.m.15 views

PYSEC-2024-271

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files,...

5.3CVSS6.4AI score0.00579EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2024/04/16 12:15 a.m.15 views

PYSEC-2024-254

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token...

4.2CVSS7AI score0.00437EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2024/04/05 7:15 p.m.15 views

PYSEC-2024-289

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...

8.6CVSS5.8AI score0.00616EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2024/02/05 11:15 p.m.15 views

PYSEC-2024-261

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request...

9.4CVSS7.1AI score0.00959EPSS
SaveExploits1References3
PyPA
PyPA
added 2024/01/30 9:15 p.m.15 views

PYSEC-2024-151

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

5.3CVSS6.7AI score0.00485EPSS
SaveExploits3References3Affected Software1
PyPA
PyPA
added 2023/12/13 10:15 a.m.15 views

PYSEC-2023-294

An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session...

6.3CVSS6.4AI score0.0041EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2023/07/19 1:15 a.m.15 views

PYSEC-2023-308

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

10CVSS6.8AI score0.6755EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2023/06/29 9:15 p.m.15 views

PYSEC-2023-97

easy-parse v0.1.1 was discovered to contain a XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

7.5CVSS8.5AI score0.00802EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2023/03/10 2:15 a.m.15 views

PYSEC-2023-318

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild...

5.5CVSS6AI score0.00278EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2022/12/17 2:15 a.m.15 views

PYSEC-2022-43016

A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireaderextractfiles of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be...

7.1CVSS7AI score0.00542EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2022/12/15 9:15 p.m.15 views

PYSEC-2022-43061

A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photodetail.html of the component Default Template Handler. The manipulation of the argument object.caption...

6.1CVSS5.9AI score0.00514EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.15 views

PYSEC-2022-43082

The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00961EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.15 views

PYSEC-2022-43090

The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-dates package. The affected version of d8s-htm is 0.1.0...

8.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/10/16 6:15 a.m.15 views

PYSEC-2022-43183

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

7.5CVSS6.7AI score0.01664EPSS
SaveExploits1References4
PyPA
PyPA
added 2022/10/11 10:15 p.m.15 views

PYSEC-2022-43029

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.15 views

PYSEC-2022-43112

The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

9.8CVSS7AI score0.01116EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.15 views

PYSEC-2022-43092

The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.0131EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.15 views

PYSEC-2022-43080

The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.0131EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/07 7:15 p.m.15 views

PYSEC-2022-43179

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

7.3CVSS7.4AI score0.00347EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/07/25 2:15 p.m.15 views

PYSEC-2022-43182

Withdrawn as duplicate of PYSEC-2022-239. The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...

8CVSS6.8AI score0.00824EPSS
SaveExploits1References2
PyPA
PyPA
added 2022/06/24 9:15 p.m.15 views

PYSEC-2022-214

The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01943EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.15 views

PYSEC-2022-43172

The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01983EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.15 views

PYSEC-2022-43164

The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.0202EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.15 views

PYSEC-2022-43133

The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01983EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/09 9:15 a.m.15 views

PYSEC-2022-43053

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address including side effects could be evaluated twice. This may result in incorrect outcomes for contracts. This issue...

8.2CVSS6.7AI score0.01328EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/02/23 9:15 a.m.15 views

PYSEC-2022-28

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1...

8.2CVSS6.8AI score0.01575EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/02/04 11:15 p.m.15 views

PYSEC-2022-79

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK. However, DCHECK is a no-op in production builds...

6.5CVSS6.9AI score0.00992EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/01/18 3:15 p.m.15 views

PYSEC-2022-43181

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

6.1CVSS6.5AI score0.0164EPSS
SaveExploits1References5
PyPA
PyPA
added 2021/12/09 5:15 p.m.15 views

PYSEC-2021-851

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected RE...

8.8CVSS7.1AI score0.0125EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2021/11/23 8:15 p.m.15 views

PYSEC-2021-850

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting XSS in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the...

5.4CVSS5.6AI score0.00583EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2021/11/23 12:15 a.m.15 views

PYSEC-2021-861

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...

8.8CVSS6.7AI score0.00398EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2021/11/05 11:15 p.m.15 views

PYSEC-2021-637

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given...

7.8CVSS7.8AI score0.00215EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/11/05 8:15 p.m.15 views

PYSEC-2021-619

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for SparseCountSparseOutput can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow...

7.1CVSS6.9AI score0.00153EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2021/10/06 6:15 p.m.15 views

PYSEC-2021-365

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0...

8.8CVSS6.9AI score0.01074EPSS
SaveExploits0References2Affected Software1
Total number of security vulnerabilities5000