Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moderate severity vulnerability that affects mailman CVE-2018-13796, GHSA-xqvg-xm9m-p2c4, PYSEC-2026-661 | Medium | 2.5% | 12 Jul, 2018 | PyPI mailman |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark CVE-2018-1334, GHSA-6mqq-8r44-vmjc, PYSEC-2018-25 | Medium | 0.5% | 12 Jul, 2018 | Maven org.apache.spark:spark-core_2.10 Maven org.apache.spark:spark-core_2.11 PyPI pyspark |
Galaxy cross-site scripting (XSS) CVE-2018-1000516, GHSA-qqr6-vm23-m488, PYSEC-2018-149 | Medium | 1.1% | 26 Jun, 2018 | PyPI galaxy-app |
Qutebrowser XSS Vulnerability CVE-2018-1000559, GHSA-m4fw-77v7-924m, PYSEC-2018-26 | Medium | 1.5% | 26 Jun, 2018 | PyPI qutebrowser |
Airbnb Knowledge Repo XSS In Comments CVE-2018-12104, GHSA-xmw7-848p-p95w, PYSEC-2018-116 | Medium | 1.3% | 17 Jun, 2018 | PyPI knowledge-repo |
Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in response, CVE-2018-1000080, PYSEC-2018-109 | Medium | 0.8% | 13 Mar, 2018 | PyPI ajenti-panel |
Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the serve CVE-2018-1000083, PYSEC-2018-112 | Medium | 1.5% | 13 Mar, 2018 | PyPI ajenti-panel |
Django denial-of-service possibility in urlize and urlizetrunc template filters CVE-2018-7536, GHSA-r28v-mw67-m5p9, PYSEC-2018-5 | Medium | 4.6% | 09 Mar, 2018 | PyPI Django PyPI django |
Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters CVE-2018-7537, GHSA-2f9x-5v75-3qv4, PYSEC-2018-6 | Medium | 4.4% | 09 Mar, 2018 | PyPI django |
Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors. CVE-2018-0525, PYSEC-2018-115 | Medium | 3.2% | 09 Mar, 2018 | PyPI jubatus |
web2py exposure of sensitive information CVE-2016-3954, GHSA-jr83-vr4j-mp6p, PYSEC-2026-1062 | Medium | 1.4% | 06 Feb, 2018 | PyPI web2py |
keycloak-httpd-client-install symlink attack vulnerability CVE-2017-15111, GHSA-vqf9-v3hc-wr54, PYSEC-2026-829 | Medium | 0.4% | 20 Jan, 2018 | PyPI keycloak-httpd-client-install |
markdown2 is vulnerable to cross-site scripting CVE-2018-5773, GHSA-p6h9-gw49-rqm4, PYSEC-2018-13 | Medium | 0.8% | 18 Jan, 2018 | PyPI markdown2 |
Reachable Assertion in OpenCV. CVE-2018-5269, GHSA-89rj-5ggj-3p9p, PYSEC-2026-2812, PYSEC-2026-703 | Medium | 1.4% | 08 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
Out-of-bounds Write in OpenCV. CVE-2018-5268, GHSA-9g8h-pjm4-q92p, PYSEC-2026-2814, PYSEC-2026-705 | Medium | 1.5% | 08 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
Plone Open Redirect CVE-2017-1000484, GHSA-xvwv-6wvx-px9x, PYSEC-2018-73 | Medium | 0.9% | 03 Jan, 2018 | PyPI Plone PyPI plone |
Products.CMFPlone Open Redirect Vulnerability CVE-2017-1000481, GHSA-8g72-gq68-6gqh, PYSEC-2018-70, PYSEC-2026-2963 | Medium | 0.7% | 03 Jan, 2018 | PyPI Plone PyPI Products.CMFPlone PyPI plone PyPI products-cmfplone |
Products.CMFPlone XSS in profile home_page property CVE-2017-1000482, GHSA-859j-668v-mrr6, PYSEC-2018-71, PYSEC-2026-2962 | Medium | 0.6% | 03 Jan, 2018 | PyPI Plone PyPI Products.CMFPlone PyPI plone PyPI products-cmfplone |
MapProxy vulnerable to cross-site scripting in demo service CVE-2017-1000426, GHSA-g4rw-82hq-8jpr, PYSEC-2026-841 | Medium | 0.8% | 02 Jan, 2018 | PyPI MapProxy PyPI mapproxy |
Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV CVE-2017-17760, GHSA-jcxv-2j3h-mg59, PYSEC-2026-2823, PYSEC-2026-711 | Medium | 2.3% | 29 Dec, 2017 | PyPI opencv-contrib-python PyPI opencv-python |
mistune Cross-site scripting (XSS) vulnerability CVE-2017-16876, GHSA-98gj-wwxm-cj3h, PYSEC-2017-18 | Medium | 2.2% | 29 Dec, 2017 | PyPI mistune |
Openstack tripleo-heat-templates unauthenticated file access CVE-2017-12155, GHSA-w8gx-hhcx-px6w, PYSEC-2026-754 | Medium | 0.3% | 12 Dec, 2017 | PyPI tripleo-heat-templates |
Aubio is vulnerable to a NULL pointer dereference CVE-2017-17554, GHSA-45h5-cqqw-9rjw, PYSEC-2017-76 | Medium | 0.8% | 12 Dec, 2017 | PyPI aubio |
The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file. CVE-2017-17555, PYSEC-2017-77 | Medium | 1.1% | 12 Dec, 2017 | PyPI aubio |
Pysaml2 improperly initializes encryption vector CVE-2017-1000246, GHSA-cq94-qf6q-mf2h, PYSEC-2017-26 | Medium | 0.9% | 17 Nov, 2017 | PyPI pysaml2 |
OpenStack Nova Filter Scheduler Bypass CVE-2017-16239, GHSA-w2wf-cgwh-vpqg, PYSEC-2026-694 | Medium | 1.4% | 14 Nov, 2017 | PyPI nova |
Pallets Werkzeug cross-site scripting vulnerability CVE-2016-10516, GHSA-h2fp-xgx6-xh6f, PYSEC-2017-43 | Medium | 2.0% | 23 Oct, 2017 | PyPI Werkzeug PyPI werkzeug |
Cross-site Scripting in Mistune CVE-2017-15612, GHSA-hpv5-v8g5-c864, PYSEC-2017-80 | Medium | 0.9% | 19 Oct, 2017 | PyPI mistune |
salt leaks git usernames and passwords to the log CVE-2015-6918, GHSA-q2x6-8gfj-hjxw, PYSEC-2017-70 | Medium | 1.2% | 10 Oct, 2017 | PyPI salt |
Plone Cross-site Scripting Vulnerability CVE-2015-7316, GHSA-vf8g-m3vq-6p4p, PYSEC-2017-53 | Medium | 1.4% | 25 Sep, 2017 | PyPI Plone PyPI plone |
instack-undercloud vulnerable to symlink attack on tmp files CVE-2017-7549, GHSA-53wm-97p6-582f, PYSEC-2017-152, PYSEC-2026-645 | Medium | 0.4% | 21 Sep, 2017 | PyPI instack PyPI instack-undercloud |
Improper Neutralization of Input During Web Page Generation in IPython CVE-2015-4706, GHSA-q326-jhw3-699g, PYSEC-2017-45 | Medium | 2.1% | 21 Sep, 2017 | PyPI ipython |
Improper Neutralization of Input During Web Page Generation in IPython CVE-2015-4707, GHSA-66gw-5xpf-gfp5, PYSEC-2017-46 | Medium | 2.3% | 20 Sep, 2017 | PyPI ipython |
Kallithea cross-site scripting (XSS) vulnerability CVE-2015-1864, GHSA-fh5c-7gmg-xmp6, PYSEC-2017-17 | Medium | 1.0% | 19 Sep, 2017 | PyPI Kallithea PyPI kallithea |
python-fedora vulnerable to an open redirect resulting in loss of CSRF protection CVE-2017-1002150, GHSA-m242-wc86-8768, PYSEC-2017-27 | Medium | 1.0% | 14 Sep, 2017 | PyPI python-fedora |
Django vulnerable to XSS on 500 pages CVE-2017-12794, GHSA-9r8w-6x8c-6jr9, PYSEC-2017-44 | Medium | 23.6% | 07 Sep, 2017 | PyPI Django PyPI django |
Out-of-bounds Write in OpenCV CVE-2017-14136, GHSA-634c-v2xv-ffpg, PYSEC-2026-2808, PYSEC-2026-700 | Medium | 1.6% | 04 Sep, 2017 | PyPI opencv-contrib-python PyPI opencv-python |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. CVE-2017-3150, GHSA-wvmq-w7m8-g9xm, PYSEC-2017-106 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality. CVE-2017-3151, GHSA-236h-r3w7-c85c, PYSEC-2017-107 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality. CVE-2017-3152, GHSA-9xwq-72vp-5j3c, PYSEC-2017-108 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality. CVE-2017-3153, GHSA-frqh-x6r7-h6mq, PYSEC-2017-109 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting. CVE-2017-3155, GHSA-q586-7p8w-9pg8, PYSEC-2017-111 | Medium | 2.1% | 29 Aug, 2017 | PyPI apache-atlas |
simplejson before 2.6.1 vulnerable to array index error CVE-2014-4616, GHSA-9772-cwx9-r4cj, PSF-2017-1, PYSEC-2026-921 | Medium | 7.8% | 24 Aug, 2017 | PyPI simplejson |
Openstack DBaaS (Trove) Improper Link Resolution Before File Access CVE-2015-3156, GHSA-98c8-36p9-gw66, PYSEC-2026-1053 | Medium | 0.5% | 11 Aug, 2017 | PyPI trove |
Restkit Does Not Validate TLS certificates CVE-2015-2674, GHSA-p9cv-hrxr-fxx8, PYSEC-2017-69 | Medium | 1.4% | 09 Aug, 2017 | PyPI restkit |
OpenStack Compute (Nova) Improper Access Control CVE-2015-2687, GHSA-97fv-22hc-mrgj, PYSEC-2017-145 | Medium | 0.3% | 09 Aug, 2017 | PyPI nova |
Zope Cross-site scripting (XSS) vulnerability in ZMI pages CVE-2009-5145, GHSA-5r4x-qc7q-vj27, PYSEC-2026-763 | Medium | 2.1% | 07 Aug, 2017 | PyPI Zope2 PyPI zope2 |
sosreport sensitive information disclosure via weak permissions of the generated archives CVE-2015-3171, GHSA-gw46-8559-cggp, PYSEC-2017-72 | Medium | 0.3% | 25 Jul, 2017 | PyPI sosreport |
An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone mu CVE-2017-9239, PYSEC-2017-112 | Medium | 2.6% | 26 May, 2017 | PyPI exiv2 |
OpenEXR invalid read CVE-2017-9112, GHSA-8m57-j273-2qg9, PYSEC-2026-727 | Medium | 1.9% | 21 May, 2017 | PyPI OpenEXR PyPI openexr |