CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2009-3724
https://notcve.org/view.php?id=CVE-2009-3724
15 Jan 2020 — python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. python-markdown2 versiones anteriores a la versión 1.0.1.14, tiene múltiples problemas de tipo cross-site scripting (XSS) . • https://snyk.io/vuln/SNYK-PYTHON-PYRAD-40000 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2019-19911 – python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
https://notcve.org/view.php?id=CVE-2019-19911
05 Jan 2020 — There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. Hay una vulnerabilidad DoS en Pillow versiones anteriores a la versión 6.2.2, causada por el archivo FpxImagePlugin.py llamando a ... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P • CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-5310 – python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode
https://notcve.org/view.php?id=CVE-2020-5310
03 Jan 2020 — libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. El archivo libImaging/TiffDecode.c en Pillow versiones anteriores a la versión 6.2.2, tiene un desbordamiento de enteros de la decodificación TIFF, relacionado con realloc. It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. It was discovered that Pillow incorrectly handled certain images. • https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2020-5311 – python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c
https://notcve.org/view.php?id=CVE-2020-5311
03 Jan 2020 — libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. El archivo libImaging/SgiRleDecode.c en Pillow versiones anteriores a la versión 6.2.2, tiene un desbordamiento de búfer de SGI. An out-of-bounds write flaw was discovered in python-pillow in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable to this flaw, which can allow an attacker to crash the application or potentially execute code on the system. It was discov... • https://access.redhat.com/errata/RHSA-2020:0566 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 9EXPL: 0CVE-2020-5312 – python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
https://notcve.org/view.php?id=CVE-2020-5312
03 Jan 2020 — libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. El archivo libImaging/PcxDecode.c en Pillow versiones anteriores a la versión 6.2.2, tiene un desbordamiento de búfer en modo PCX P. A flaw was discovered in python-pillow does where it does not properly restrict operations within the bounds of a memory buffer when decoding PCX images. An application that uses python-pillow to decode untrusted images may be vulnerable to this flaw, which can allow an attacker to crash the applic... • https://access.redhat.com/errata/RHSA-2020:0566 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.2EPSS: 0%CPEs: 9EXPL: 0CVE-2020-5313 – python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images
https://notcve.org/view.php?id=CVE-2020-5313
03 Jan 2020 — libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. El archivo libImaging/FliDecode.c en Pillow versiones anteriores a la versión 6.2.2, tiene un desbordamiento de búfer de FLI. An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read. It was discovered that Pil... • https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0161
https://notcve.org/view.php?id=CVE-2014-0161
02 Jan 2020 — ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate. ovirt-engine-sdk-python versiones anteriores a la versión 3.4.0.7 y 3.5.0.4, no comprueba que el nombre de host del endpoint remoto coincida con el Common Name (CN) o subjectAltName según lo... • https://access.redhat.com/security/cve/cve-2014-0161 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-19274 – openSUSE Security Advisory - openSUSE-SU-2020:0609-1
https://notcve.org/view.php?id=CVE-2019-19274
26 Nov 2019 — typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.) typed_ast versiones 1.3.0 y 1.3.1, presenta una lectura fuera de límites de la función handle_keywo... • https://bugs.python.org/issue36495 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-19275 – openSUSE Security Advisory - openSUSE-SU-2020:0609-1
https://notcve.org/view.php?id=CVE-2019-19275
26 Nov 2019 — typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.) typed_ast versiones 1.3.0 y 1.3.1, presenta una lectura fuera de límites de la función ast_for_arguments... • https://bugs.python.org/issue36495 • CWE-125: Out-of-bounds Read •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5578
https://notcve.org/view.php?id=CVE-2012-5578
25 Nov 2019 — Python keyring has insecure permissions on new databases allowing world-readable files to be created El llavero de Python posee permisos no seguros en bases de datos nuevas, permitiendo que archivos de tipo world-readable sean creados. • http://www.openwall.com/lists/oss-security/2012/11/27/4 • CWE-276: Incorrect Default Permissions •