strahlenexposition

Certifi removes GLOBALTRUST root certificate

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` (from huntr)

Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

Werkzeug safe_join() allows Windows special device names

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

urllib3 does not control redirects in browsers and Node.js

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

Mistune has XSS via unescaped figclass/figwidth in Figure directive

jaraco.context Has a Path Traversal Vulnerability

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Python-Markdown has an Uncaught Exception

Pillow has a heap buffer overflow with nested list coordinates

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Flask session does not add `Vary: Cookie` header when accessed in some ways

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

pip Path Traversal vulnerability

pytest has vulnerable tmpdir handling

Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Tornado has incomplete validation of cookie attributes

Vulnerable OpenSSL included in cryptography wheels

Tornado vulnerable to excessive logging caused by malformed multipart form data

nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Werkzeug safe_join() allows Windows special device names with compound extensions

Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

Mistune Math Plugin has an XSS Escape Bypass

Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

Requests vulnerable to .netrc credentials leak via malicious URLs

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

Requests `Session` object does not verify requests after making first request with verify=False

Pillow affected by out-of-bounds write when loading PSD images