Ecosystem
PyPI
7,110 known vulnerabilities.
Most affected packages
2,904 results · Clear filters · Feed
-
Medium 6.5
OpenStack Nova Server Resource Faults Leak External Exception Details
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in t…
-
Medium 6.1
Cross-site scripting in recommender-xblock
Recommender before 2018-07-18 allows XSS.
-
Medium 4.6
Exposure of Sensitive Information to an Unauthorized Actor in ansible
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…
-
Medium 6.1
Invenio-App vulnerable to host header injection attack
invenio-app before 1.1.1 allows host header injection.
-
Medium 5.4
Cross-site Scripting in invenio-communities
invenio-communities before 1.0.0a20 allows XSS.
-
Medium 5.4
Cross-site scripting invenio-records
invenio-records before 1.2.2 allows XSS.
-
Medium 6.1
Cross-site Scripting in invenio-previewer
invenio-previewer before 1.0.0a12 allows XSS.
-
Medium 5.3
Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. …
-
Medium 6.5
http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer…
-
Medium 6.1
Twisted CRLF Injection
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
-
Medium 5.5
Openstack Octavia Access Control Vulnerability
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a …
-
Medium 6.1
Django Cross-site Scripting in AdminURLFieldWidget
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value sto…
-
Medium 5.4
PyDio Stored XSS Vulnerability
A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and af…
-
Medium 5.5
Capstone SEGV caused by a read memory access
Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c.
-
Medium 6.5
NULL Pointer Dereference in Google TensorFlow
NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.
-
Medium 6.5
Null pointer dereference in TensorFlow leads to exploitation
Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.
-
Medium 5.7
python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
-
Medium 5.1
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
-
Medium 5.9
Matrix Sydent mishandles emails
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parsea…
-
Medium 6.1
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…
-
Medium 6.1
Improper Neutralization of CRLF Sequences in urllib3 library for Python
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
-
Medium 4.8
Apache Airflow vulnerable to Stored XSS
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
-
Medium 6.1
Moderate severity vulnerability that affects roundup
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
-
Medium 6.5
OpenStack Neutron overlapping security group rules prevents compute node network configuration
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks…
-
Medium 4.3
Tryton Improper Access Control
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to …
-
Medium 6.1
Jupyter Notebook open redirect vulnerability
In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
-
Medium 6.1
Open Redirect vulnerability in jupyterhub and notebook
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers run…
-
Medium 4.2
Ansible Path Traversal vulnerability
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
-
Medium 4.0
Ceilometer Prints Sensitive Configuration Data to Log
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
-
Medium 5.5
Openstack Octavia allows Insertion of Sensitive Information into Log File
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private key…
-
Medium 6.5
OpenStack Neutron's unsupported dport option prevents applying security groups
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that …
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Int…
-
Medium 5.5
Apache Airflow vulnerable to Stored XSS
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
-
Medium 5.5
Boolector use after free
In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.
-
Medium 5.5
Pyspark User Impersonation Vulnerability
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
-
Medium 6.1
Buildbot CRLF Injection
www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
-
Medium 6.1CVE-2019-6802 Scanner template
CRLF Injection in pypiserver
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
-
Medium 6.1
Bodhi Cross-site Scripting Vulnerability
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
-
Medium 6.5
Improper Input Validation in Django
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404…
-
Medium 6.5
PyKMIP Denial of service vulnerability
OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of t…