Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
136 results · page 3 of 3
Jun 24, 2022The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package.CVE-2022-33003 · Other software · Pypi · reported by MITRECritical 9.8
The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Watools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package.CVE-2022-33002 · Other software · Pypi · reported by MITRECritical 9.8
The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Explore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package.CVE-2022-33001 · Other software · Pypi · reported by MITRECritical 9.8
The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Aamiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package.CVE-2022-33000 · Other software · Pypi · reported by MITRECritical 9.8
The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Ml-scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.CVE-2022-32999 · Other software · Pypi · reported by MITRECritical 9.8
The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Cloudlabeling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package.CVE-2022-32998 · Other software · Pypi · reported by MITRECritical 9.8
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Cryptoasset-data-downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package.CVE-2022-32997 · Other software · Pypi · reported by MITRECritical 9.8
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Rootinteractive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package.CVE-2022-32996 · Other software · Pypi · reported by MITRECritical 9.8
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
- Product
- Django-navbar-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 24, 2022The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30885 · Other software · ESA · reported by MITRECritical 9.8
The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
- Product
- Pyesasky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 8, 2022api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.CVE-2022-31313 · Other software · Api-res-py Project · reported by MITRECritical 9.8
api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.
- Product
- Api-res-py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 8, 2022pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor.CVE-2022-30882 · Other software · Pyanxdns Project · reported by MITRECritical 9.8
pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.
- Product
- Pyanxdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 8, 2022The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30877 · Other software · Keep Project · reported by MITRECritical 9.8
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.
- Product
- Keep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
May 8, 2022marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.CVE-2022-28470 · Other software · Python · reported by MITRECritical 9.8
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
- Product
- Pypi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jan 30, 2022Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-0339 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2022Improper Access Control in Pypi calibreweb prior to 0.6.16.CVE-2022-0273 · Other software · janeczku · reported by security@huntr.devMedium 6.5
Improper Access Control in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.CVE-2022-0352 · Other software · janeczku · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus.CVE-2021-32838 · Other software · python-restx · reported by GitHubHigh 7.5
Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
- Product
- flask-restx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org.CVE-2021-39158 · Other software · NVIDIA · reported by GitHubHigh 8.8
NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe.
- Product
- caffe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-29471 · Other software · matrix-org · reported by GitHubLow 3.7
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21393 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21392 · Other software · matrix-org · reported by GitHubMedium 6.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21394 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21333 · Other software · matrix-org · reported by GitHubMedium 6.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21332 · Other software · matrix-org · reported by GitHubMedium 6.9
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21274 · Other software · matrix-org · reported by GitHubMedium 4.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21273 · Other software · matrix-org · reported by GitHubLow 3.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2021CairoSVG is a Python (pypi) package.CVE-2021-21236 · Other software · Kozea · reported by GitHubMedium 5.7
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
- Product
- CairoSVG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2020Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.CVE-2020-27589 · Other software · Synopsys · reported by MITREHigh 7.5
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Product
- Hub-rest-api-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.synopsys.comgithub.com
Oct 26, 2020In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions.CVE-2020-15271 · Other software · d0c-s4vage · reported by GitHubCritical 9.3
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
- Product
- lookatme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2020A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.CVE-2020-15904 · Other software · Pypi · reported by MITREHigh 7.8
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
- Product
- Bsdiff4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2019lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly valiCVE-2019-13962 · Other software · Videolan · reported by MITRECritical 9.8
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
- Product
- VLC Media Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orglists.opensuse.org
Jan 24, 2019CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.CVE-2019-6802 · Other software · Python · reported by MITREMedium 6.1
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
- Product
- Pypiserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2013easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which CVE-2013-1633 · Other software · Python · reported by MITREMedium 6.8
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Product
- Setuptools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreddit.compypi.python.org
Aug 5, 2013pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-CVE-2013-1630 · Other software · Guillaume Gauvrit · reported by MITREMedium 6.8
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Product
- Pyshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2013pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middlCVE-2013-1629 · Other software · Pypa · reported by MITREMedium 6.8
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
- Product
- PIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpip-installer.orgpip-installer.org
Aug 27, 2012Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition thaCVE-2011-4944 · Other software · Python · reported by Red HatLow 1.9
Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.python.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.