Ecosystem
PyPI
7,110 known vulnerabilities.
Most affected packages
7,091 results · Feed
-
High 7.5
Denial of service in readExternal method
The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and wr…
-
Medium 6.1
Open redirect in web2py
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
-
Unscored —
The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The curr…
-
Unscored —
The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerab…
-
Unscored —
The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request packag…
-
Unscored —
The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request packa…
-
Unscored —
The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request pac…
-
Unscored —
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor vi…
-
Unscored —
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the req…
-
Unscored —
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the reque…
-
High 8.8
Salt's PAM auth fails to reject locked accounts
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects…
-
Medium 6.5
Denial of Service in python-ldap
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authent…
-
High —
XSS Vulnerability in Markdown Editor
### Impact InvenTree uses [EasyMDE](https://github.com/Ionaru/easy-markdown-editor) for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default, EasyMDE does not sanitize input data, and it i…
-
Critical 9.0
Improper Neutralization of Formula Elements in a CSV File in inventree/inventree
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
-
Critical 9.0
Unrestricted Upload of File with Dangerous Type in inventree/inventree
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
-
Medium —
Formula Injection in Exported Data
### Impact Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection ### Patches - The issue is addressed in the upcoming 0.8.0 release - This fix will also be back-ported to the 0.7.x branch, applied…
-
High —
Insufficient HTML Sanitization
### Impact Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views. The problem here …
-
High 7.1
Known or guessable hidden files may be accessed in Jupyter Server
Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home…
-
Medium 4.3
Forced Browsing in Jupyter Notebook
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not a…
-
High 8.4
Code Injection in nuitka/nuitka
Code Injection in GitHub repository nuitka/nuitka prior to 0.9.
-
High —
Cross Site Scripting vulnerability in django-jsonform's admin form.
### Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks. Thi…
-
Critical 9.8
Couchbase Sync Gateway admin credentials not verified when using X.509 client cert authentication
An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Ser…
-
Critical 9.8
Backdoor in api-res-py
api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.
-
Critical 9.8
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current …
-
Medium 4.2
Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a gi…
-
High 8.2
Multiple evaluation of contract address in call in vyper
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incor…
-
Critical 9.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limit…
-
Medium 6.5
Access control issue in AlekSIS-Core
An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
-
High 8.1
Command Injection
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags ca…
-
Critical —
Embedded Malicious Code in ctx
The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.
-
High 7.5
Phoenix-ws source code and data in extensions folder is publicly available
### Impact All of the source code, files, and folders in `phoenix_files/extensions/` are available to end users through a simple HTTP GET request. ### Patches The issue has been patched. The users of version 1.0.6 and above are not effected.
-
Medium 6.5
Uncaught Exception (due to a data race) leads to process termination in Waitress
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exceptio…
-
High 8.6
Flower OAuth authentication bypass
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting dow…
-
Critical 9.8
Denial of service in bottle
Bottle before 0.12.20 mishandles errors during early request binding.
-
Critical —
Malware in ctx
The `ctx` hosted project on [PyPI](https://pypi.org/project/ctx/) was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of `os.environ.items()` when instantiating `Ctx` objects…
-
Medium —
`CHECK` failure in depthwise ops via overflows
### Impact The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) caused by overflowing the number of elements in a tensor: ```python import tensorflow as tf input = tf.constant(1, shape=…
-
High 7.5
Buffer over-flow in Pillow
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
-
Unscored —CVE-2022-29361 Public exploit
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggli…
-
Unscored —
The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which c…
-
High 7.4
Key confusion through non-blocklisted public key formats in PyJWT
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorith…