Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43114

The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43125

The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43120

The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43121

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43087

The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43105

The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43110

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0...

9.8CVSS7.6AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43103

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 2:15 p.m.10 views

PYSEC-2022-43118

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/13 9:15 p.m.10 views

PYSEC-2022-43137

LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp...

5.5CVSS7.3AI score0.00287EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/06 11:15 p.m.10 views

PYSEC-2022-43149

Open Asset Import Library assimp commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes...

6.5CVSS7.3AI score0.00648EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2022/09/06 5:15 p.m.10 views

PYSEC-2022-265

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

8.8CVSS8.1AI score0.01738EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/09/05 10:15 a.m.10 views

PYSEC-2022-43069

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue...

8.8CVSS7AI score0.01089EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/09/02 7:15 a.m.10 views

PYSEC-2022-263

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...

9.8CVSS7AI score0.01881EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/08/29 3:15 a.m.10 views

PYSEC-2022-257

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity...

9.8CVSS7.2AI score0.08873EPSS
SaveExploits3References1Affected Software1
PyPA
PyPA
added 2022/08/24 4:15 p.m.10 views

PYSEC-2022-253

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansiblerunner.interface.runcommand, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual...

7.8CVSS8.2AI score0.00316EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/08/03 2:15 p.m.10 views

PYSEC-2022-245

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...

8.8CVSS6.9AI score0.00821EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/08/01 10:15 p.m.10 views

PYSEC-2022-248

Streamlit is a data oriented application development framework for python. Users hosting Streamlit apps that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially othe...

6.5CVSS6.7AI score0.01608EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/07/28 11:15 p.m.10 views

PYSEC-2022-43136

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package...

9.8CVSS7.8AI score0.01196EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/07/26 6:15 a.m.10 views

PYSEC-2022-243

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

7.5CVSS7.1AI score0.01677EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/07/25 2:15 p.m.10 views

PYSEC-2022-43182

Withdrawn as duplicate of PYSEC-2022-239. The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...

8CVSS6.8AI score0.00805EPSS
SaveExploits1References2
PyPA
PyPA
added 2022/07/22 3:15 p.m.10 views

PYSEC-2022-43166

The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party...

9.8CVSS7.6AI score0.01561EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/07/18 7:15 a.m.10 views

PYSEC-2022-236

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

8.8CVSS7.8AI score0.93076EPSS
SaveExploits12References2Affected Software1
PyPA
PyPA
added 2022/07/06 6:15 p.m.10 views

PYSEC-2022-233

opensshkeyparser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker...

7.7CVSS6.8AI score0.01269EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/06/27 6:15 p.m.10 views

PYSEC-2022-222

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

7.5CVSS7AI score0.02091EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-219

The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01901EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43168

The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.01977EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43165

The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.01333EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43169

The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.01977EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43172

The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01941EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/14 9:15 p.m.10 views

PYSEC-2022-211

Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of rootdir that contains the starting user's home directory, then the underlying REST API ca...

9CVSS6.2AI score0.00846EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2022/06/02 2:15 p.m.10 views

PYSEC-2022-42973

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

8.6CVSS7.2AI score0.01027EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/05/06 12:15 a.m.10 views

PYSEC-2022-187

TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version...

4.3CVSS6.8AI score0.00518EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/04/16 4:15 p.m.10 views

PYSEC-2022-43153

Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3code.c called indirectly from CompileBranchTable in m3compile.c...

5.5CVSS7.5AI score0.00597EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2022/04/12 5:15 a.m.10 views

PYSEC-2022-191

A SQL injection issue was discovered in QuerySet.explain in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary with dictionary expansion as the options argument, and placing the injection payload in an option name...

9.8CVSS8AI score0.02919EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/04/04 6:15 p.m.10 views

PYSEC-2022-196

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

7.5CVSS6.8AI score0.00994EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/03/31 11:15 p.m.10 views

PYSEC-2022-180

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by...

7.5CVSS6.8AI score0.0108EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2022/03/31 11:15 p.m.10 views

PYSEC-2022-178

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to mntner objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perfo...

7.5CVSS7AI score0.014EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/03/21 7:15 p.m.10 views

PYSEC-2022-170

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

9.8CVSS6.9AI score0.01621EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/03/17 9:15 p.m.10 views

PYSEC-2022-229

gradio is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, gradio suffers from Improper Neutralization of Formula Elements in a CSV File. The gradio library has a flagging functionality which saves input/output data into a CSV file on t...

8.8CVSS7.2AI score0.01298EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/03/17 1:15 p.m.10 views

PYSEC-2022-169

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

7.5CVSS6.9AI score0.0178EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/03/07 11:15 p.m.10 views

PYSEC-2022-34

HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and...

6.5CVSS6.8AI score0.0165EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/03/06 11:15 p.m.10 views

PYSEC-2022-161

Open Redirect in GitHub repository archivy/archivy prior to 1.7.0...

6.1CVSS6.8AI score0.00628EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/02/25 9:15 p.m.10 views

PYSEC-2022-35

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

5.4CVSS6.5AI score0.00753EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/02/25 9:15 a.m.10 views

PYSEC-2022-29

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. This issue affects Apache Airflow versions 2.2.3 and below...

6.1CVSS6.5AI score0.02601EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/02/23 11:15 p.m.10 views

PYSEC-2022-33

b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race...

4.7CVSS6AI score0.00217EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/02/23 9:15 a.m.10 views

PYSEC-2022-28

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1...

8.2CVSS6.8AI score0.01575EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/02/07 10:15 p.m.10 views

PYSEC-2022-27

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advise...

7.5CVSS6.9AI score0.01381EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/02/04 11:15 p.m.10 views

PYSEC-2022-73

Tensorflow is an Open Source Machine Learning Framework. When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow...

6.5CVSS6.8AI score0.00469EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/02/04 11:15 p.m.10 views

PYSEC-2022-158

Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference. In the default scenario, all devices are allowed, so flr-configproto is nullptr. The fix will be included in TensorFlow...

6.5CVSS6.9AI score0.00774EPSS
SaveExploits1References3Affected Software1
Total number of security vulnerabilities5000