GitHub

The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.
Reference…

bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn’t filter a “\r\n” sequence, which leads to a CRLF attack, as demonstrated by a redirect(“233\r\nSet-Cookie: name=salt”) call.
Re…

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.
References

https…

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
References

https://nvd.nist.gov/vuln/detail/CVE-2015-8557
h…

IPython (Interactive Python) is a command shell. Cross-site request forgery in the REST API is possible in in IPython 2 and 3. Versions 2.4.1 and 3.2.3 contain patches.
References

https://nvd.nist.gov/vuln/detail/CVE-2015-5607
https://github.com/ipyth…

Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
References

https://nvd.nist.gov/vuln/detail/CVE-2017-1000242
https://jenkins.io/security/advisory/2017-04-27/
http://www.s…

Gitea before 1.16.7 does not escape the shell out for git fetch remote allowing for shell command injection
References

https://nvd.nist.gov/vuln/detail/CVE-2022-30781
https://github.com/go-gitea/gitea/pull/19487
https://github.com/go-gitea/gitea/pull/…

Calibre-Web before 0.6.18 allows user table SQL Injection.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-30765
https://github.com/janeczku/calibre-web/blob/master/SECURITY.md
https://github.com/janeczku/calibre-web/releases/tag/0.6.18
https://g…

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-29351
https://github.com/Jermolene/TiddlyWik…

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-…