Advisory Catalog

Plone Open Redirection vulnerability via next parameter

Tryton Directory Traversal vulnerability

Salt has insufficient argument validation in several modules

SaltStack MITM SSH attack in salt-ssh

SaltStack insecurely uses /tmp

Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.

Minion identity not validated in saltstack

SaltStack Privilege Escalation vulnerability

PyCrypto does not properly reseed PRNG before allowing access

PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name

Django Denial of Service Vulnerability in the authentication framework

Django Directory Traversal via ssi template tag

python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate

Apache Qpid Python client Improper certificate validation

OpenStack Swift Unchecked user input in XML responses

Improper Input Validation in pip

pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository

Setuptools vulnerable to Man-in-the-middle attacks

OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM

OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function

The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.

OpenStack Keystone Insufficient token expiration

Python Keyring does not securely initialize encryption cipher

Django Allows Arbitrary URL Generation

Tweepy does not verify SSL Certificate

OpenStack Keystone Improper Authentication vulnerability

OpenStack Keystone Allows Remote User Account Creation

Elixir can leak information due to weak use of crypto

PyFriBidi Buffer overflow in the fribidi_utf8_to_unicode function

Arbitrary file overwrite in OpenStack Nova

Django Image Field Vulnerable to Image Decompression Bombs

Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

Trytond allows modification of privileges of arbitrary users

Cobbler subject to Command Injection

Tornado CRLF injection vulnerability

feedparser denial of service vulnerability

Paste Script has improper group memberships permissions

Plone Denial of Service vulnerability

Denial of service in django

Django Might Allow CSRF Requests via URL Verification

Django Vulnerable to Cache Poisoning

Django Cross-Site Request Forgery vulnerability

Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

Zope Command Execution Vulnerability

Apache Libcloud does not verify SSL certificates for HTTPS connections

High severity vulnerability that affects Plone and Zope2

Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

feedparser denial of service vulnerability

Cross-site request forgery in Django

Improper query string handling in Django