40 results · Feed
-
Unscored —
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
-
Critical 9.8CVE-2021-3177 EPSS 24%
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…
-
Unscored —
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a deni…
-
Unscored —CVE-2014-4650 EPSS 24%
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path…
-
Unscored —
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via …
-
Medium 6.5
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…
-
Unscored —
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI scrip…
-
Medium 5.9CVE-2019-5010 EPSS 21%
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.…
-
Medium 5.4
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection …
-
Medium 5.3
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The …
-
Medium 4.3
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly valida…
-
Critical 9.8
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 a…
-
Critical 9.1CVE-2019-9948 EPSS 12%
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…
-
Medium 5.4
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …
-
Medium 6.5
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …
-
Medium 5.3
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorr…
-
Medium 5.3CVE-2018-14647 EPSS 11%
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…
-
Unscored —CVE-2018-1000802 EPSS 20%
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements …
-
Medium 6.5
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…
-
Medium 4.3
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3li…
-
Low 3.6
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14…
-
Unscored —
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringo…
-
Medium 5.9
simplejson before 2.6.1 vulnerable to array index error
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…
-
Unscored —CVE-2016-0772 EPSS 15%
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an …
-
Unscored —
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) bef…
-
Unscored —CVE-2016-5636 EPSS 25%
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3…
-
Unscored —
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wild…
-
Unscored —
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x b…
-
Unscored —
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive inform…
-
Unscored —
Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute …
-
Unscored —CVE-2014-1912 EPSS 27%
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3…
-
Unscored —
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character i…
-
Unscored —
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x bef…
-
Unscored —
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restrict…
-
Unscored —
Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been writt…
-
Unscored —
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7…
-
Unscored —
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify re…
-
Unscored —
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does n…
-
Unscored —
Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent …
-
Unscored —CVE-2010-2089 EPSS 15%
The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengt…