Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,934 results · page 27 of 39
May 19, 2023Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-32675 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project.CVE-2023-32309 · Other software · facelessuser · reported by GitHubHigh 7.5
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has
- Product
- pymdown-extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023Planet is software that provides satellite data.CVE-2023-32303 · Other software · planetlabs · reported by GitHubMedium 5.2
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.
- Product
- planet-client-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32059 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32058 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-31146 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Vyper is a pythonic smart contract language for the EVM.CVE-2023-30837 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-30629 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.vyperlang.orggithub.com
Apr 21, 2023There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number ofCVE-2023-30798 · Other software · Encode · reported by VulnCheckHigh 7.5
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
- Product
- Starlette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack withCVE-2023-25601 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 18, 2023The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.CVE-2023-27043 · Other software · Siemens · reported by MITREMedium 5.3
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
- Product
- RUGGEDCOM ROX MX5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023sqlparse is a non-validating SQL parser module for Python.CVE-2023-30608 · Other software · andialbrecht · reported by GitHubMedium 5.5
sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- sqlparse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.CVE-2023-29374 · Other software · Langchain · reported by MITRECritical 9.8
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.
- Product
- Langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software.CVE-2023-28117 · Other software · getsentry · reported by GitHubHigh 7.6
Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application. In order for these sensitive values to be leaked, the Sentry SDK configuration must have `sendDefaultPII` set to `True`; one must use a custom name for either `SESSION_COOKIE_NAME` or `CSRF_COOKIE_NAME` in one's Django settings; and one must not be configured in one's organization or project settings to use Sentry's data scrubbing features to account for the custom cookie names. As of version 1.14.0, the Django integration of the `sentry-sdk` will detect the custom cookie names based on one's Django settings and will remove the values from the payload before sending the data to Sentry. As a workaround, use the SDK's filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events, this can be done with the `before
- Product
- sentry-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical.CVE-2018-25082 · Other software · zwczou · reported by VulDBMedium 6.3
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
- Product
- WeChat SDK Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execCVE-2023-1306 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.8
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
- Product
- InsightCloudSec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.divvycloud.comnephosec.com
Mar 7, 2023OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models.CVE-2023-27476 · Other software · geopython · reported by GitHubHigh 8.2
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.
- Product
- OWSLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Gradio is an open-source Python library to build machine learning and data science demos and web applications.CVE-2023-25823 · Other software · gradio-app · reported by GitHubMedium 5.4
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users are recommended to update to 3.19.1 or later where the FRP solution has been properly tested.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requiremenCVE-2023-24107 · Other software · Hour Of Code Python 2015 Project · reported by MITRECritical 9.8
hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerability allows attackers to access sensitive user information and execute arbitrary code.
- Product
- Hour Of Code Python 2015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank charactCVE-2023-24329 · Other software · Siemens · reported by MITREHigh 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an auCVE-2022-26032 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Distribution For Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming lanCVE-2023-24816 · Other software · ipython · reported by GitHubMedium 4.5
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.
- Product
- ipython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2023-23931 · Other software · pyca · reported by GitHubMedium 4.8
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur.CVE-2022-45786 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition to the latest version of AGE that is used for PostgreSQL 11 or PostgreSQL 12. The update of AGE will add a new function to enable parameterization of the cypher() function, which, in conjunction with the driver updates, will resolve this issue. Background (for those who want more information): After thoroughly researching this issue, we found that due to the nature of the cypher() function, it was not easy to parameterize the values passed into it. This enabled SQL injections, if the developer of the driver wasn't careful. The developer of the Golang and Pyton drivers didn't fully utilize parameterization, likely because of this, thus enabling SQL injections. The obvious fix to this issue is to use parameterization in the drivers for all PG SQL queries. However, parameterizing all PG queries is complicated by the fact that the cypher() function call itself cannot be parameterized direc
- Product
- Apache AGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 30, 2023isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.CVE-2023-24622 · Other software · Includesecurity · reported by MITREMedium 5.3
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
- Product
- Safeurl-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Spotipy is a light weight Python library for the Spotify Web API.CVE-2023-23608 · Other software · spotipy-dev · reported by GitHubNone
Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.
- Product
- spotipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of serviCVE-2021-32837 · Other software · python-mechanize · reported by GitHubHigh 7.5
mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.
- Product
- mechanize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022LiuOS is a small Python project meant to imitate the functions of a regular operating system.CVE-2022-46179 · Other software · LiuWoodsCode · reported by GitHubCritical 9.2
LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest commit (c658b4f3e57258acf5f6207a90c2f2169698ae22) by requiring the var to be set to true, causing a test script to run instead of being able to login. A potential workaround is to check for the GITHUB_ACTIONS environment variable and set it to "" (no quotes) to null the variable and force credential checks.
- Product
- LiuOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicioCVE-2022-40899 · Other software · Pythoncharmers · reported by MITREHigh 7.5
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
- Product
- Python-future
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled iCVE-2022-40898 · Other software · Wheel Project · reported by MITREHigh 7.5
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
- Product
- Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageICVE-2022-40897 · Other software · Python · reported by MITREMedium 5.9
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
- Product
- Setuptools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdCVE-2022-46609 · Other software · Python3-restfulapi Project · reported by MITRECritical 9.8
Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Python3-restfulapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.CVE-2022-23491 · Other software · certifi · reported by GitHubMedium 6.8
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
- Product
- python-certifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Dec 6, 2022A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrarCVE-2022-44900 · Other software · Py7zr Project · reported by MITRECritical 9.1
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Product
- Py7zr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 6, 2022Passeo is an open source python password generator.CVE-2022-23472 · Other software · ArjunSharda · reported by GitHubMedium 5.9
Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Passeo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a malicCVE-2022-24439 · Other software · Gitpython Project · reported by report@snyk.ioHigh 8.1
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
- Product
- Gitpython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 28, 2022Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\PytCVE-2022-45305 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder.
- Product
- Chocolatey Python3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.CVE-2022-45199 · Other software · Python · reported by MITREHigh 7.5
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orggithub.com
Nov 14, 2022Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).CVE-2022-45198 · Other software · Python · reported by MITREHigh 7.5
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgcwe.mitre.org
Nov 9, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply CVE-2022-42965 · Other software · snowflake-connector-python · reported by reefs@jfrog.comLow 3.7
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Nov 9, 2022An issue was discovered in Python before 3.11.1.CVE-2022-45061 · Other software · Siemens · reported by MITREHigh 7.5
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 7, 2022The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44054 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44053 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44052 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-dates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44051 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44050 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-json package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44049 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44048 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-domains package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-43306 · Other software · Democritus · reported by MITREHigh 8.8
The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-dates package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-timer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-43305 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-algorithms package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.