Advisory Catalog

Mitmweb in mitmproxy allows DNS Rebinding attacks

Ansible fails to properly mark lookup-plugin results as unsafe

Mercurial mishandles integer addition and subtraction

PyYAML insecurely deserializes YAML strings leading to arbitrary code execution

Ansible fails to cache SSH host keys

Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems

SaltStack Salt allows compromised salt-minions to impersonate the salt-master

Diffoscope may write to arbitrary locations due to an untrusted archive

Code injection in rope

Koji hub call does not perform correct access checks

SiCKRAGE Discloses Plaintext Credentials

Mercurial Incorrect Access Control vulnerability

Eve allows execution of arbitrary code

Paramiko not properly checking authentication before processing other requests

django-anymail Includes Sensitive Information in Log Files

AsyncSSH SSH Server Authentication Bypass

Bleach URI Scheme Restriction Bypass

web2py remote code execution via hardcoded encryption key in session.connect function

Django-Anymail prone to a timing attack

Cobbler vulnerable to arbitrary code execution

pysaml2 Improper Authentication vulnerability

Mercurial vulnerable to arbitrary code injection

Ansible Insertion of Sensitive Information into Log File vulnerability

OpenStack Swauth object/proxy server writing Auth Token to log file

Recurly vulnerable to SSRF

Unsafe deserialization in confire

django_make_app is vulnerable to Code Injection

Unsafe deserialization in MLAlchemy

Unsafe pyyaml load usage in PyAnyAPI

Unsafe deserialization in owlmixin

Dulwich RCE Vulnerability

SaltStack Salt Directory traversal vulnerability in minion id validation

Mercurial is vulnerable to shell injection attack

python-kerberos vulnerable to KDC spoofing attacks

SaltStack Salt Directory traversal vulnerability in minion id validation

salt password information leaked in debug logs

Session Fixation in ipsilon

Loaded Databook of Tablib prone to python insertion resulting in command execution

Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

web2py is vulnerable to password brute-force attack

OpenStack Nova logs sensitive context from notification exceptions

PySAML2 XML external entity attack

Buffer Overflow in pycrypto

Salt allows deleted minions to read or write to minions with the same id

python-jose failure to use a constant time comparison for HMAC keys

Django user with hardcoded password created when running tests on Oracle

Django DNS Rebinding Vulnerability

OpenStack Murano Code Execution