MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pymini…

▾ Midnightzlib · zlibEPSS 3.2%via NVD

CVE-2023-23930High· 7.2

2y ago

Pickle serialization vulnerable to Deserialization of Untrusted Data

▾ Twilightvantage6 · vantage6EPSS 0.89%via OSV

Tagged “pip”

Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification

Cross-Site Request Forgery vulnerability in Prefect

Ansible galaxy-importer Path Traversal vulnerability

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

vantage6-server node accepts non-whitelisted algorithms from malicious server

AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

PyArrow: Arbitrary code execution when loading a malicious data file

AsyncSSH Rogue Extension Negotiation

AsyncSSH Rogue Session Attack

Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

Synapse vulnerable to leak of remote user device information

Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Home Assistant vulnerable to account takeover via auth_callback login

Command Injection in pip when used with Mercurial

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

dtale vulnerable to Remote Code Execution through the Custom Filter Input

Nautobot vulnerable to exposure of hashed user passwords via REST API

Fides Information Disclosure Vulnerability in Config API Endpoint

Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload

Fides JavaScript Injection Vulnerability in Privacy Center URL

Langchain Server-Side Request Forgery vulnerability

mycli has Inadequate Encryption Strength

PDM Trojan Lockfile

TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

urllib3's request body not stripped after redirect from 303 status changes request method to GET

vantage6 does not properly delete linked resources when deleting a collaboration

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field

Pickle serialization vulnerable to Deserialization of Untrusted Data