density-maps

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP has CRLF injection through multipart part content type header construction

PyTorch susceptible to local Denial of Service

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow has a heap buffer overflow with nested list coordinates

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

pytest has vulnerable tmpdir handling

PyTorch Improper Resource Shutdown or Release vulnerability

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP accepts duplicate Host headers

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

setuptools vulnerable to Command Injection via package URL

PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

AIOHTTP Vulnerable to Cookie Parser Warning Storm

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

tqdm CLI arguments injection attack

AIOHTTP vulnerable to DoS through chunked messages

Jinja has a sandbox breakout through malicious filenames

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP has a Multipart Header Size Bypass

aiohttp: CRLF injection in multipart headers

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

AIOHTTP has HTTP response splitting via \r in reason phrase

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Jinja has a sandbox breakout through indirect reference to format method

PyTorch is vulnerable to memory corruption through its torch.lstm_cell function

filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock