Lucene search
+L
PypaMost viewed

7586 matches found

PyPA
PyPA
added 2021/09/27 6:15 a.m.16 views

PYSEC-2021-352

furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client...

6.5CVSS7.1AI score0.00678EPSS
SaveExploits3References3Affected Software1
PyPA
PyPA
added 2021/09/27 6:15 a.m.16 views

PYSEC-2021-353

furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIGTERM...

7.8CVSS7.7AI score0.03341EPSS
SaveExploits2References3Affected Software1
PyPA
PyPA
added 2021/09/20 10:15 p.m.16 views

PYSEC-2021-327

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin which just comes out of the box are subject to a denial of service attac...

7.5CVSS6.8AI score0.01891EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2021/09/03 2:15 a.m.16 views

PYSEC-2021-342

A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system...

10CVSS7.1AI score0.01716EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2021/08/31 5:15 p.m.16 views

PYSEC-2021-425

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership list of members, with their display names of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history...

3.5CVSS6.8AI score0.01457EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2021/08/16 6:15 p.m.16 views

PYSEC-2021-144

XML External Entities XXE in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'...

9.8CVSS8.2AI score0.02771EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/08/16 6:15 p.m.16 views

PYSEC-2021-341

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

9.8CVSS7.1AI score0.02277EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2021/08/12 11:15 p.m.16 views

PYSEC-2021-314

TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor...

5.5CVSS7.1AI score0.00172EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2021/08/12 9:15 p.m.16 views

PYSEC-2021-267

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on thi...

5.5CVSS7.2AI score0.00152EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2021/06/30 12:15 p.m.16 views

PYSEC-2021-349

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service...

7.5CVSS6.8AI score0.01172EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/06/17 5:15 p.m.16 views

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

5.4CVSS5.8AI score0.01109EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2021/06/09 6:15 p.m.16 views

PYSEC-2021-100

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...

8.2CVSS6.9AI score0.00779EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2021/05/28 7:15 p.m.16 views

PYSEC-2021-136

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some...

7.1CVSS6.6AI score0.01023EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-174

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedResizeBilinear by passing in invalid thresholds for the quantization. This is because the...

7.8CVSS7.4AI score0.00211EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-687

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from tf.rawops.LoadAndRemapMatrix. This is because the...

5.5CVSS6.8AI score0.00189EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-728

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the DepthwiseConv TFLite operator is vulnerable to a division by zero...

5.5CVSS6.9AI score0.00189EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-233

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the EmbeddingLookup TFLite operator is vulnerable to a division by zero...

7.8CVSS6.9AI score0.00201EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-713

TensorFlow is an end-to-end open source platform for machine learning. The Prepare step of the SpaceToDepth TFLite operator does not check for 0 before divisionhttps://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/spacetodepth.ccL63-L67. An...

7.8CVSS6.9AI score0.00201EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/14 8:15 p.m.16 views

PYSEC-2021-677

TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixTriangularSolvehttps://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matrixtriangularsolveopimpl.hL160-L240 fails to terminate kernel...

5.5CVSS7AI score0.00217EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2021/05/07 5:15 a.m.16 views

PYSEC-2021-101

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter...

10CVSS7.3AI score0.02113EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2021/05/07 5:15 a.m.16 views

PYSEC-2021-102

A Cross-site scripting XSS vulnerability exists in StackLift LocalStack 0.12.6...

6.1CVSS6.2AI score0.00846EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2021/03/23 6:15 p.m.16 views

PYSEC-2021-432

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid free or realloc calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and ...

7.1CVSS6.7AI score0.01811EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2021/03/23 5:15 p.m.16 views

PYSEC-2021-140

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...

7.5CVSS6.7AI score0.02759EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2021/03/21 5:15 a.m.16 views

PYSEC-2021-19

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

6.1CVSS6.4AI score0.04035EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2021/03/08 9:15 p.m.16 views

PYSEC-2021-44

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...

6.5CVSS6.5AI score0.01499EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2020/12/21 6:15 p.m.16 views

PYSEC-2020-346

Withdrawn as duplicate of PYSEC-2020-50. The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyt...

6.1CVSS6.3AI score0.01379EPSS
SaveExploits1References4
PyPA
PyPA
added 2020/12/09 12:15 a.m.16 views

PYSEC-2020-98

Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserve...

8.7CVSS6.9AI score0.01303EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2020/10/16 6:15 a.m.16 views

PYSEC-2020-225

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under because the Python eval function is used. This may result in...

9.9CVSS7.6AI score0.03286EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2020/09/30 8:15 p.m.16 views

PYSEC-2020-263

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious...

6.1CVSS6.5AI score0.01286EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2020/09/25 7:15 p.m.16 views

PYSEC-2020-318

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.asstring, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentati...

7.5CVSS6.9AI score0.00965EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2020/09/25 7:15 p.m.16 views

PYSEC-2020-294

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the...

8.1CVSS6.9AI score0.00671EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2020/09/25 7:15 p.m.16 views

PYSEC-2020-119

In Tensorflow version 2.3.0, the SparseCountSparseOutput and RaggedCountSparseOutput implementations don't validate that the weights tensor has the same shape as the data. The check exists for DenseCountSparseOutput, where both tensors are fully specified. In the sparse and ragged count weights a...

9.9CVSS7AI score0.00903EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2020/09/11 6:15 p.m.16 views

PYSEC-2020-3

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

5.5CVSS6.5AI score0.00573EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2020/09/09 6:15 p.m.16 views

PYSEC-2020-145

Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...

8.7CVSS6.9AI score0.0067EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2020/08/27 10:15 p.m.16 views

PYSEC-2020-252

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName...

9.8CVSS7.1AI score0.00765EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2020/08/21 5:15 p.m.16 views

PYSEC-2020-265

In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive action...

9.6CVSS7AI score0.01156EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2020/06/24 1:15 p.m.16 views

PYSEC-2020-37

In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASICAUTHLOGIN and BASICAUTHPASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is...

2.4CVSS6.9AI score0.00358EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2020/05/07 12:15 a.m.16 views

PYSEC-2020-56

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

5.5CVSS7AI score0.00705EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2020/03/15 10:15 p.m.16 views

PYSEC-2020-40

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

9.1CVSS6.9AI score0.01615EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2020/03/12 1:15 p.m.16 views

PYSEC-2020-259

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request...

9.8CVSS6.9AI score0.03973EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2020/01/24 8:15 p.m.16 views

PYSEC-2020-230

In Django User Sessions django-user-sessions before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the...

8.8CVSS6.3AI score0.00527EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2020/01/23 9:15 p.m.16 views

PYSEC-2020-86

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...

5.4CVSS6.3AI score0.00809EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2020/01/02 6:15 p.m.16 views

PYSEC-2020-245

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...

5.9CVSS6.9AI score0.00416EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2019/12/26 5:15 p.m.16 views

PYSEC-2019-138

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

8.2CVSS6.5AI score0.02587EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2019/12/10 8:15 p.m.16 views

PYSEC-2019-251

The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML...

7.5CVSS7.2AI score0.01465EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2019/10/30 10:15 p.m.16 views

PYSEC-2019-216

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

4.8CVSS7.3AI score0.01277EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2019/08/22 5:15 p.m.16 views

PYSEC-2019-178

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

7.2CVSS6.8AI score0.02178EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2019/07/29 3:15 p.m.16 views

PYSEC-2019-25

invenio-communities before 1.0.0a20 allows XSS...

5.4CVSS7AI score0.00864EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2019/07/02 10:15 p.m.16 views

PYSEC-2019-20

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

9.8CVSS7.2AI score0.01518EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2019/04/23 9:29 p.m.16 views

PYSEC-2019-224

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent...

6.5CVSS6.9AI score0.00527EPSS
SaveExploits0References1Affected Software1
Total number of security vulnerabilities5000