Ecosystem
PyPI
7,093 known vulnerabilities.
Most affected packages
149 results · Clear filters · Feed
-
High 8.8
Apache Spark shell command injection vulnerability via Spark UI
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…
KEV Mar 7, 2023 -
High 8.1CVE-2022-21728 Public exploit
Out of bounds read in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` doe…
-
High 7.2CVE-2021-44255 Public exploit
Unrestricted Upload of File with Dangerous Type in motionEye
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
-
High 7.5
SQL Injection in Casdoor
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
-
High 8.8CVE-2021-32849 Public exploit
Arbitrary command execution in Gerapy
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
-
High 8.0CVE-2022-21668 Public exploit
Pipenv's requirements.txt parsing allows malicious index url in comments
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requiremen…
-
High 7.8CVE-2021-43811 Public exploit
Code injection via unsafe YAML loading
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary c…
-
High 8.6CVE-2021-41078 Public exploit
Nameko Arbitrary code execution due to YAML deserialization
Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.
-
High 7.5
Directory traversal in mkdocs
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://g…
-
High 8.1CVE-2021-39214 Public exploit
Lacking Protection against HTTP Request Smuggling in mitmproxy
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/…
-
High 8.4
Deserialization of Untrusted Data in parlai
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
-
High 7.5CVE-2021-40839 Public exploit
Infinite Loop in rencode
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
-
High 7.1CVE-2021-21401 Public exploit
Invalid free() call in Nanopb
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `…
-
High 7.8CVE-2020-28243 Public exploit
SaltStack Salt command injection via a crafted process name
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blackliste…
-
High 8.8
Remote code execution (RCE) in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…
KEV Jan 18, 2022 -
High 7.0CVE-2019-16784 Public exploit
Local Privilege Escalation present only on the Windows version of PyInstaller
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which ha…
-
High 8.5
Dynamic modification of RPyC service due to missing security check
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
-
High 7.5CVE-2019-14751 Public exploit
NLTK Vulnerable To Path Traversal
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
-
High 7.5
Pallets Werkzeug vulnerable to Path Traversal
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
-
High 7.7CVE-2017-11427 Public exploit
Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the atta…
-
High 7.5CVE-2019-6690 Public exploit
Improper Input Validation python-gnupg
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…
-
High 7.5CVE-2018-18074 Public exploit
Insufficiently Protected Credentials in Requests
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
-
High 7.5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
-
High 8.8CVE-2015-7293 Public exploit
Plone vulnerable to cross-site request forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
-
High 8.8
Incorrect Default Permissions in Supervisor
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
-
High 7.5CVE-2017-12852 Public exploit
Numpy missing input validation
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
-
High 8.8
Mercurial has Incorrect Permission Assignment for Critical Resource
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
-
High 7.5CVE-2013-4200 Public exploit
Plone Open Redirection vulnerability via next parameter
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites fi…
-
High —
Zope Command Execution Vulnerability
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.