Ecosystem
PyPI
7,110 known vulnerabilities.
Most affected packages
7,091 results · Feed
-
High 8.1
Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in t…
-
Medium 6.5
-
Medium —
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www…
-
Medium 6.1
Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
-
Medium 6.1
Apache Airflow prior to 2.4.2 has an open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
-
Medium 5.4
Apache Spark XSS vulnerability in log viewer UI Javascript
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in log…
-
Medium 5.5
OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, …
-
Critical 9.9
DataHub missing JWT signature check
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadat…
-
High 7.5
Ansible leaks password to logs
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading …
-
High 7.8
wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<…
-
Medium 5.4
Twisted vulnerable to NameVirtualHost Host header injection
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped in…
-
High 8.8
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vu…
-
Low 2.8
Business Logic Errors in ikus060/rdiffweb
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
-
High 7.5
Apache IoTDB prior to 0.13.3 allows DoS
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to …
-
High 8.1
Improper Control of Generation of Code ('Code Injection') in Azure CLI
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have …
-
Medium 5.5
Plaintext storage of tokens in pulp_ansible
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
-
Unscored —
Invalid-free in _dealloc
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52587 ``` Crash type: Invalid-free Crash state: _dealloc _Py_DECREF frame_dealloc ```
-
Critical 9.8
Buffer overflow in sponge queue functions
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
-
Critical 9.8CVE-2022-37298 Public exploit
Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control
Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to th…
-
Medium 6.0
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
-
Medium 4.5
Missing Authentication for Critical Function in ikus060/rdiffweb
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
-
High 7.5
MobSF allows attackers to read arbitrary files via a crafted HTTP request
Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
-
High 7.5
Django denial-of-service vulnerability in internationalized URLs
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
-
Medium 4.5
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
-
Low 3.7
Origin Validation Error in ikus060/rdiffweb
Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
-
Medium 5.6
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
-
High 7.8
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, chang…
-
Critical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a…
-
Critical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
Critical 9.8
The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
Critical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
Critical 9.8
The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Unscored —
The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by…
-
Critical 9.8
The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by…
-
Critical 9.8
The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thir…