photovoltaic_systems

Certifi removes GLOBALTRUST root certificate

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

PyTorch susceptible to local Denial of Service

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

urllib3 does not control redirects in browsers and Node.js

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow has a heap buffer overflow with nested list coordinates

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

pip Path Traversal vulnerability

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

PyTorch Improper Resource Shutdown or Release vulnerability

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

setuptools vulnerable to Command Injection via package URL

PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

tqdm CLI arguments injection attack

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

Jinja has a sandbox breakout through malicious filenames

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Command Injection in pip when used with Mercurial

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Jinja has a sandbox breakout through indirect reference to format method

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

PyTorch is vulnerable to memory corruption through its torch.lstm_cell function

filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

PyTorch is vulnerable to memory corruption through its torch.jit.script function

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

PyTorch is vulnerable to memory corruption through its unpack_sequence function

filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory