Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
Denial of service (DoS) via deformation `multipart/form-data` boundary
CVE-2024-39162Medium· 6.1pyspider Cross-site Scripting vulnerability
pyspider Cross-site Scripting vulnerability
CVE-2024-53861Low· 2.2pyjwt: Issuer field partial matches allowed in pyjwt (CVE-2024-53861)
A flaw was found in the pyJWT package. An incorrect string comparison is run for `iss` checking, which allows for partial matches. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature c…
CVE-2024-52008Medium· 5.7Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
CVE-2024-53916High· 7.5OpenStack Neutron can use an incorrect ID during policy enforcement
OpenStack Neutron can use an incorrect ID during policy enforcement
CVE-2024-52787Critical· 9.1libre-chat Path Traversal vulnerability
libre-chat Path Traversal vulnerability
CVE-2024-53899High· 7.8virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)
A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,int…
CVE-2024-11393High· 8.80dayPoCtransformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11…
A flaw was found in the MaskFormer model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attac…
CVE-2024-11392High· 7.50dayPoCtransformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11392)
A flaw was found in the MobileViTV2 model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an atta…
CVE-2024-11394High· 8.80dayPoCtransformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11394)
A flaw was found in the Trax model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to…
CVE-2024-52804High· 7.5Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
CVE-2023-40017High· 7.5GeoNode Server Side Request forgery
GeoNode Server Side Request forgery
CVE-2024-52803High· 7.5LLama Factory Remote OS Command Injection Vulnerability
LLama Factory Remote OS Command Injection Vulnerability
CVE-2024-11406Medium· 6.9django CMS Attributes Field Cross-site Scripting
django CMS Attributes Field Cross-site Scripting
CVE-2024-11404Medium· 5.5Django Filer Unrestricted Upload of File with Dangerous Type
Django Filer Unrestricted Upload of File with Dangerous Type
CVE-2024-52581High· 7.5Litestar allows unbounded resource consumption (DoS vulnerability)
Litestar allows unbounded resource consumption (DoS vulnerability)
CVE-2024-47533Critical· 9.8PoCcobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CVE-2024-52304Medium· 5.9aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304)
A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for…
CVE-2024-52303High· 7.5aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVE-2024-52303)
A flaw was found in the aiohttp package. A memory leak can occur in certain configurations when a request produces a `MatchInfoError`. This issue was caused by adding an entry to a cache on each request due to the building of each `MatchIn…
CVE-2023-6110Medium· 5.5OpenStack improperly deletes access rules
OpenStack improperly deletes access rules
CVE-2021-3988Medium· 6.1Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
CVE-2021-3986Medium· 4.3Generation of Error Message Containing Sensitive Information in janeczku/calibre-web
Generation of Error Message Containing Sensitive Information in janeczku/calibre-web
CVE-2021-3987Medium· 5.4Improper Access Control in janeczku/calibre-web
Improper Access Control in janeczku/calibre-web
CVE-2024-45784High· 7.5Apache Airflow: Sensitive configuration values are not masked in the logs by default
Apache Airflow: Sensitive configuration values are not masked in the logs by default
CVE-2024-52524MediumReDoS in giskard's transformation.py (GHSL-2024-324)
ReDoS in giskard's transformation.py (GHSL-2024-324)
CVE-2024-4311Medium· 5.4Missing ratelimit on passwrod resets in zenml
Missing ratelimit on passwrod resets in zenml
CVE-2023-34049Medium· 6.7Salt preflight script could be attacker controlled
Salt preflight script could be attacker controlled
CVE-2024-11079Medium· 5.5A flaw was found in Ansible-Core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote da…
CVE-2024-50378Medium· 6.5Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
CVE-2024-51998High· 8.6changedetection.io path traversal using file URI scheme without supplying hostname
changedetection.io path traversal using file URI scheme without supplying hostname