Lucene search
+L
PypaMost viewed

7250 matches found

PyPA
PyPA
added 2022/12/06 6:15 p.m.10 views

PYSEC-2022-42997

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python random library for random value selection. The python random library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator...

7.5CVSS6.8AI score0.00791EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/28 9:15 p.m.10 views

PYSEC-2022-43175

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contai...

8.4CVSS6.3AI score0.00806EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2022/11/22 1:15 a.m.10 views

PYSEC-2022-42987

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts...

8.8CVSS7AI score0.00685EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43128

The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00997EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43127

The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00923EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43081

The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-json package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00991EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43089

The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43075

The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.00991EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/11/07 3:15 p.m.10 views

PYSEC-2022-43086

The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0...

9.8CVSS7.6AI score0.01012EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/10/13 8:15 p.m.10 views

PYSEC-2022-43160

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0...

9.8CVSS6.8AI score0.00371EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43050

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43030

The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43020

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43047

The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43019

The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0...

9.8CVSS7AI score0.05173EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43025

The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/11 10:15 p.m.10 views

PYSEC-2022-43032

The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

9.8CVSS7AI score0.01264EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/10/10 12:15 p.m.10 views

PYSEC-2022-43158

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4...

6.1CVSS6.8AI score0.00525EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2022/10/06 6:16 p.m.10 views

PYSEC-2022-43156

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4...

9.8CVSS6.8AI score0.00471EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/09/30 7:15 p.m.10 views

PYSEC-2022-43139

A vulnerability in the LIEF::MachO::SegmentCommand::virtualaddress function of LIEF v0.12.1 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted MachO file...

6.5CVSS6.6AI score0.00622EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/28 9:15 p.m.10 views

PYSEC-2022-296

Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8...

4.6CVSS6.7AI score0.00508EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/26 5:15 a.m.10 views

PYSEC-2022-288

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel class due to the eval statement...

9.8CVSS5.5AI score0.02094EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/09/21 12:15 p.m.10 views

PYSEC-2022-283

Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...

8.8CVSS6.7AI score0.00457EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/21 8:15 a.m.10 views

PYSEC-2022-279

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...

7.5CVSS6.7AI score0.01632EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43107

The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01043EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43106

The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01043EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43114

The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43125

The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43079

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 4:15 p.m.10 views

PYSEC-2022-43120

The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43105

The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 3:15 p.m.10 views

PYSEC-2022-43104

The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/19 2:15 p.m.10 views

PYSEC-2022-43118

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0...

9.8CVSS7AI score0.01071EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/09/06 11:15 p.m.10 views

PYSEC-2022-43149

Open Asset Import Library assimp commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes...

6.5CVSS7.3AI score0.00661EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2022/09/06 5:15 p.m.10 views

PYSEC-2022-265

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

8.8CVSS8.1AI score0.01773EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/09/05 10:15 a.m.10 views

PYSEC-2022-43069

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue...

8.8CVSS7AI score0.01111EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/09/02 7:15 a.m.10 views

PYSEC-2022-263

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...

9.8CVSS7AI score0.01918EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2022/08/29 3:15 a.m.10 views

PYSEC-2022-257

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity...

9.8CVSS7.2AI score0.08873EPSS
SaveExploits3References1Affected Software1
PyPA
PyPA
added 2022/08/26 5:55 p.m.10 views

PYSEC-2022-252

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

7.2AI score
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2022/08/24 4:15 p.m.10 views

PYSEC-2022-253

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansiblerunner.interface.runcommand, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual...

7.8CVSS8.2AI score0.00316EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/08/03 2:15 p.m.10 views

PYSEC-2022-245

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...

8.8CVSS6.9AI score0.00828EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2022/08/01 7:15 p.m.10 views

PYSEC-2022-247

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

2.7CVSS6.7AI score0.0071EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2022/07/28 11:15 p.m.10 views

PYSEC-2022-43136

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package...

9.8CVSS7.8AI score0.01224EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/07/26 6:15 a.m.10 views

PYSEC-2022-243

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

7.5CVSS7.1AI score0.01717EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2022/07/22 3:15 p.m.10 views

PYSEC-2022-242

The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party...

9.8CVSS7.7AI score0.01599EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/07/22 3:15 p.m.10 views

PYSEC-2022-43166

The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party...

9.8CVSS7.6AI score0.01599EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2022/07/18 7:15 a.m.10 views

PYSEC-2022-236

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

8.8CVSS7.8AI score0.93076EPSS
SaveExploits12References2Affected Software1
PyPA
PyPA
added 2022/07/06 6:15 p.m.10 views

PYSEC-2022-233

opensshkeyparser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker...

7.7CVSS6.8AI score0.01269EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2022/07/05 10:15 a.m.10 views

PYSEC-2022-230

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

7.5CVSS6.9AI score0.02462EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2022/06/27 6:15 p.m.10 views

PYSEC-2022-222

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

7.5CVSS7AI score0.02091EPSS
SaveExploits0References2Affected Software1
Total number of security vulnerabilities5000