Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2022/12/07 10:15 p.m.10 views

PYSEC-2022-42986

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust...

7.5CVSS6.8AI score0.00535EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/12/07 9:15 a.m.10 views

PYSEC-2022-43063

Code injection in paddle.audio.functional.getwindow in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution...

10CVSS8AI score0.01096EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/12/06 6:15 p.m.10 views

PYSEC-2022-42997

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python random library for random value selection. The python random library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator...

7.5CVSS6.8AI score0.00791EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/22 1:15 a.m.10 views

PYSEC-2022-42987

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts...

8.8CVSS7AI score0.00685EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/12 8:15 p.m.10 views

PYSEC-2022-43055

Hyperledger Fabric 2.3 allows attackers to cause a denial of service orderer crash by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist...

7.5CVSS6.7AI score0.00797EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43128

The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00997EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43109

The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43086

The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43089

The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43075

The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00991EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/10/16 6:15 a.m.10 views

PYSEC-2022-43183

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

7.5CVSS6.7AI score0.01603EPSS
SaveExploits1References4
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43020

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

9.8CVSS7AI score0.01219EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43030

The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0...

9.8CVSS7AI score0.01219EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43050

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01219EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43019

The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0...

9.8CVSS7AI score0.04989EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43032

The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01219EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/30 7:15 p.m.10 views

PYSEC-2022-43139

A vulnerability in the LIEF::MachO::SegmentCommand::virtualaddress function of LIEF v0.12.1 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted MachO file...

6.5CVSS6.6AI score0.00622EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/28 9:15 p.m.10 views

PYSEC-2022-296

Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8...

4.6CVSS6.7AI score0.00508EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/26 5:15 a.m.10 views

PYSEC-2022-288

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel class due to the eval statement...

9.8CVSS5.5AI score0.02094EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/09/21 12:15 p.m.10 views

PYSEC-2022-283

Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...

8.8CVSS6.7AI score0.00457EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/21 8:15 a.m.10 views

PYSEC-2022-279

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...

7.5CVSS6.7AI score0.01632EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43106

The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01043EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43079

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43114

The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43125

The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43120

The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43121

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43105

The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43102

The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-hypothesis package...

9.8CVSS7.7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43110

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0...

9.8CVSS7.6AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43103

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 2:15 p.m.10 views

PYSEC-2022-43118

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/13 9:15 p.m.10 views

PYSEC-2022-43137

LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp...

5.5CVSS7.3AI score0.00287EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/06 11:15 p.m.10 views

PYSEC-2022-43149

Open Asset Import Library assimp commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes...

6.5CVSS7.3AI score0.00648EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2022/09/06 5:15 p.m.10 views

PYSEC-2022-265

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

8.8CVSS8.1AI score0.01738EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/09/05 10:15 a.m.10 views

PYSEC-2022-43069

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue...

8.8CVSS7AI score0.01089EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/09/02 7:15 a.m.10 views

PYSEC-2022-263

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...

9.8CVSS7AI score0.01881EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/08/29 3:15 a.m.10 views

PYSEC-2022-257

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity...

9.8CVSS7.2AI score0.08873EPSS
SaveExploits3References1Affected Software1
PyPA
PyPA
added 2022/08/24 4:15 p.m.10 views

PYSEC-2022-253

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansiblerunner.interface.runcommand, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual...

7.8CVSS8.2AI score0.00316EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/08/03 2:15 p.m.10 views

PYSEC-2022-245

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...

8.8CVSS6.9AI score0.00821EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/08/01 10:15 p.m.10 views

PYSEC-2022-248

Streamlit is a data oriented application development framework for python. Users hosting Streamlit apps that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially othe...

6.5CVSS6.7AI score0.01608EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/07/28 11:15 p.m.10 views

PYSEC-2022-43136

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package...

9.8CVSS7.8AI score0.01196EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/07/26 6:15 a.m.10 views

PYSEC-2022-243

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

7.5CVSS7.1AI score0.01677EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/07/22 3:15 p.m.10 views

PYSEC-2022-43166

The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party...

9.8CVSS7.6AI score0.01561EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/07/18 7:15 a.m.10 views

PYSEC-2022-236

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

8.8CVSS7.8AI score0.93076EPSS
SaveExploits12References2Affected Software1
PyPA
PyPA
added 2022/07/06 6:15 p.m.10 views

PYSEC-2022-233

opensshkeyparser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker...

7.7CVSS6.8AI score0.01269EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/06/27 6:15 p.m.10 views

PYSEC-2022-222

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

7.5CVSS7AI score0.02091EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-219

The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01901EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43168

The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.01977EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/06/24 9:15 p.m.10 views

PYSEC-2022-43165

The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.9AI score0.01333EPSS
SaveExploits0References2Affected Software1
Total number of security vulnerabilities5000