Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2022-37189High· 7.5MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
CVE-2022-23451High· 8.1Barbican authorization flaw before v14.0.0
Barbican authorization flaw before v14.0.0
CVE-2022-38369High· 8.8Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVE-2022-2806Medium· 5.5sosreport Exposure of Sensitive Information vulnerability
sosreport Exposure of Sensitive Information vulnerability
CVE-2022-23452Medium· 4.9openstack-barbican Denial of Service vulnerability
openstack-barbican Denial of Service vulnerability
CVE-2022-36046Medium· 5.3Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affecte…
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandl…
CVE-2022-34668Critical· 9.8PoCNVFLARE unsafe deserialization due to Pickle
NVFLARE unsafe deserialization due to Pickle
CVE-2021-3563Critical· 9.1Openstack Keystone Incorrect Authorization vulnerability
Openstack Keystone Incorrect Authorization vulnerability
CVE-2022-25304High· 7.5Uncontrolled Resource Consumption in asyncua and opcua
Uncontrolled Resource Consumption in asyncua and opcua
CVE-2022-1930Medium· 5.9Regular expression denial of service in eth-account
Regular expression denial of service in eth-account
CVE-2022-38362High· 8.8Remote code execution in Apache Airflow Docker's Provider
Remote code execution in Apache Airflow Docker's Provider
CVE-2022-2822Low· 3.7OctoPrint does not have rate limiting on the login page
OctoPrint does not have rate limiting on the login page
GHSA-pcjh-6r5h-r92rHighdjango-sendfile2 before 0.7.0 contains reflected file download vulnerability
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
CVE-2021-32862Medium· 5.4nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
CVE-2022-35920High· 8.3sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
CVE-2022-37394Low· 3.3OpenStack Nova Changing vnic_type breaks compute service restart
OpenStack Nova Changing vnic_type breaks compute service restart
CVE-2022-34558Critical· 9.8WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execut…
WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
CVE-2022-2514Medium· 6.1Fava time and filter parameters vulnerable to reflected Cross-site Scripting
Fava time and filter parameters vulnerable to reflected Cross-site Scripting
CVE-2022-24294High· 7.5Apache MXNet vulnerable to potential denial-of-service by excessive resource consumption
Apache MXNet vulnerable to potential denial-of-service by excessive resource consumption
CVE-2018-25045Medium· 6.1Django REST framework XSS Vulnerability
Django REST framework XSS Vulnerability
CVE-2021-42343Critical· 9.8Workers for local Dask clusters mistakenly listened on public interfaces
Workers for local Dask clusters mistakenly listened on public interfaces
CVE-2022-31153Medium· 6.5OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
CVE-2022-31573Critical· 9.3ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
CVE-2021-37839Medium· 4.3Apache Superset allows authenticated users to access metadata they have no permission to
Apache Superset allows authenticated users to access metadata they have no permission to
CVE-2022-31116High· 7.5Incorrect handling of invalid surrogate pair characters
Incorrect handling of invalid surrogate pair characters
CVE-2022-31117Medium· 5.9Potential double free of buffer during string decoding
Potential double free of buffer during string decoding
CVE-2022-33146Medium· 6.1Open redirect in web2py
Open redirect in web2py
CVE-2022-31604Critical· 9.8Unsafe deserialisation in the PKI implementation scheme of NVFlare
Unsafe deserialisation in the PKI implementation scheme of NVFlare
CVE-2022-31605Critical· 9.8Unsafe yaml deserialization in NVFlare
Unsafe yaml deserialization in NVFlare
CVE-2021-46823Medium· 6.5Denial of Service in python-ldap
Denial of Service in python-ldap