Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,934 results · page 24 of 39
Jun 14, 2024A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution.CVE-2024-27171 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python scriCVE-2024-37014 · Other software · langflow · reported by MITRECritical 9.8
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
- Product
- langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Apport does not disable python crash handler before entering chrootCVE-2022-28657 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.8
Apport does not disable python crash handler before entering chroot
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on CVE-2024-37065 · Other software · Skops-dev · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.
- Product
- Skops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhiddenlayer.comhiddenlayer.com
May 21, 2024An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.CVE-2024-35060 · Other software · nasa · reported by MITREHigh 7.5
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.
- Product
- ait-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
May 21, 2024An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.CVE-2024-35059 · Other software · nasa · reported by MITREHigh 7.5
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.
- Product
- ait-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
May 18, 2024aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio.CVE-2024-34083 · Other software · aio-libs · reported by GitHubMedium 5.4
aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.
- Product
- aiosmtpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024llama-cpp-python is the Python bindings for llama.cpp.CVE-2024-34359 · Other software · abetlen · reported by GitHubCritical 9.6
llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.
- Product
- llama-cpp-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other CVE-2024-4030 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7.1
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-MachineCVE-2024-27453 · Other software · extremenetworks · reported by MITREHigh 8.6
In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).
- Product
- extremexos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextreme-networks.my.site.comexsiliumsecurity.com
May 3, 2024sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker.CVE-2024-34073 · Other software · aws · reported by GitHubHigh 7.8
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.
- Product
- sagemaker-python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker.CVE-2024-34072 · Other software · aws · reported by GitHubHigh 7.8
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources.
- Product
- sagemaker-python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024tqdm is an open source progress bar for Python and CLI.CVE-2024-34062 · Other software · tqdm · reported by GitHubMedium 4.8
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- tqdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability.CVE-2023-50204 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21297.
- Product
- G416
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
May 2, 2024D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability.CVE-2023-50202 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21295.
- Product
- G416
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
May 2, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-30251 · Other software · aio-libs · reported by GitHubHigh 7.5
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
May 1, 2024Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL datCVE-2024-32979 · Other software · nautobot · reported by GitHubHigh 7.5
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module.CVE-2023-46960 · Other software · pure_python_pxe · reported by MITREHigh 8.6
Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module.
- Product
- pypxe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024pyload is an open-source Download Manager written in pure Python.CVE-2024-32880 · Other software · pyload · reported by GitHubCritical 9.1
pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.
- Product
- pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token witCVE-2024-33664 · Other software · python-jose_project · reported by MITREMedium 5.3
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
- Product
- python-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats.CVE-2024-33663 · Other software · python-jose_project · reported by MITREMedium 6.5
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
- Product
- python-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32649 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32648 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32647 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32646 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32645 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32481 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024Python Social Auth is a social authentication/registration mechanism.CVE-2024-32879 · Other software · python-social-auth · reported by GitHubMedium 4.9
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
- Product
- social-app-django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-27306 · Other software · aio-libs · reported by GitHubMedium 6.1
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).CVE-2024-21090 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 8.3.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- MySQL Connectors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024NiceGUI is an easy-to-use, Python-based UI framework.CVE-2024-32005 · Other software · zauberzeug · reported by GitHubHigh 8.2
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2024eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet frCVE-2023-29483 · Other software · eventlet · reported by MITREHigh 7
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
- Product
- eventlet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts dueCVE-2024-31871 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts due to improper certificate validation. IBM X-Force ID: 287306.
- Product
- Security Verify Access Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 2, 2024Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo.CVE-2024-30248 · Other software · piccolo-orm · reported by GitHubHigh 7.7
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
- Product
- piccolo_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products.CVE-2024-29189 · Other software · ansys · reported by GitHubHigh 7.4
PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
- Product
- pyansys-geometry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbandit.readthedocs.iogithub.com
Mar 20, 2024JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.CVE-2024-28102 · Other software · latchset · reported by GitHubMedium 6.8
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
- Product
- jwcrypto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.CVE-2024-0450 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.2
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 19, 2024An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.CVE-2023-6597 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7.8
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 19, 2024Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in CVE-2024-21503 · Other software · python_software_foundation · reported by report@snyk.ioMedium 5.3
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Product
- black
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages.CVE-2023-41334 · Other software · astropy · reported by GitHubHigh 8.4
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
- Product
- astropy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio.CVE-2024-27305 · Other software · aio-libs · reported by GitHubMedium 5.3
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- aiosmtpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activCVE-2024-25723 · Other software · zenmlio · reported by MITREHigh 8.8
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
- Product
- zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-26149 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24564 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=urlCVE-2024-0243 · Other software · langchain-ai · reported by security@huntr.devHigh 8.1
With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559
- Product
- langchain-ai/langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2024The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet.CVE-2024-26151 · Other software · FelixSchwarz · reported by GitHubHigh 8.2
The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `<script>` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.
- Product
- mjml-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2024-26130 · Other software · pyca · reported by GitHubHigh 7.5
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis.CVE-2024-23346 · Other software · materialsproject · reported by GitHubCritical 9.3
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
- Product
- pymatgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python.CVE-2024-21624 · Other software · nonebot · reported by GitHubMedium 5.7
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
- Product
- nonebot2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2024-24563 · Other software · vyperlang · reported by GitHubCritical 9.8
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of signed integers to be used as indexes to arrays. The vulnerability is present in different forms in all versions, including `0.3.10`. For ints, the 2's complement representation is used. Because the array was declared very large, the bounds checking will pass Negative values will simply be represented as very large numbers. As of time of publication, a fixed version does not exist. There are three potential vulnerability classes: unpredictable behavior, accessing inaccessible elements and denial of service. Class 1: If it is possible to index an array with a negative integer without reverting, this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract. Class 2: If a contract has an invariant in the form `assert index < x`, the developer will suppose that no elements on indexes `y | y >= x` are accessible. However, by using nega
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.