Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in Pillow causes repeated copying of long comments when saving GIF images. This can lead to excessive CPU consumption and potential denial of service when processing untrusted image uploads.
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
A vulnerability in Pillow allows crafted Microsoft Image Composer (MIC) files with embedded TIFF streams to cause an infinite loop and 100% CPU usage when checking frame counts, leading to denial of service in environments with olefile installed.
A vulnerability in Pillow allows an invalid or double free when rendering text with a stroke from untrusted fonts, potentially leading to memory corruption or crashes.
Pillow lacks sanitization when constructing Ghostscript commands from input filenames, permitting command-line argument injection that can be escalated to remote code execution.
A command injection vulnerability in virtualenv's activate.fish script allows arbitrary command execution if an environment path or prompt contains a backslash before a quote. Fixed in version 21.14.2.
A vulnerability in virtualenv activation scripts allows arbitrary code execution if an environment path or prompt contains placeholder names. Activating a maliciously crafted virtual environment can cause the generated script to execute unintended commands.
A heap buffer overflow vulnerability in Pillow allows attackers to cause out-of-bounds writes when decoding specially crafted lossless JPEG images using draft scaling. This issue occurs when libjpeg-turbo silently ignores scaling requests, leading to memory corruption or crashes.
Unbounded recursion in Pillow when parsing PDF page trees or trailer chains can cause severe CPU and memory exhaustion or crashes during PDF append operations.
An issue in Pillow allows a maliciously crafted GIF to cause excessive memory allocation when an application handles decompression errors during frame seeking and reuses the image object. This can lead to memory exhaustion and denial of service.
An out-of-bounds read vulnerability in Pillow's tiled-TIFF decoder can allow a specially crafted TIFF image to crash the process or expose adjacent heap memory into the decoded pixel buffer.
An overflow in aiohttp during Max-Age processing can prevent connections from closing properly, allowing an attacker to temporarily exhaust the connector pool until garbage collection runs.
In AIOHTTP, attackers sending absolute-form HTTP requests can spoof the request scheme. If an application relies on the scheme for security checks, attackers may bypass security logic by making unencrypted connections appear encrypted or vice versa.
A vulnerability in aiohttp allows a subdomain to remove the Host-Only flag from existing parent domain cookies, potentially weakening cookie scoping protections.
A vulnerability in AIOHTTP allows attackers to exhaust file descriptors using specially crafted multipart requests. This can lead to resource exhaustion and potential denial of service.
Default trust stores in affected uv versions trust a root CA with compromised intermediate CA keys. An attacker with access to these compromised keys could forge certificates for arbitrary hostnames, allowing man-in-the-middle attacks on TLS traffic.
Certain certifi releases bundled a root certificate with compromised intermediate keys. An attacker on the network path could issue forged certificates for any hostname and intercept or modify TLS connections.
A vulnerability in JupyterLab allows a command link trust prompt to mark a currently active document as trusted instead of the clicked one, potentially allowing buttons in untrusted documents to execute without confirmation.
A vulnerability in aiohttp allows an attacker to keep an idle connection open indefinitely before sending data because the keepalive timeout was not enforced during the initial portion of a request.
A missing comma in Mercury's blocklist leaves the /api/terminals endpoint unprotected, allowing unauthenticated network attackers to spawn an interactive OS-level root shell.
Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.
An unauthenticated remote code execution vulnerability in Mercury allows network clients to execute arbitrary Python code as the server process user on default deployments due to anonymous access to kernel endpoints.
LoopX serve-status uses an overly permissive CORS policy with wildcard headers on unauthenticated loopback read endpoints. This allows malicious websites visited by the operator to exfiltrate control-plane state and private Markdown files from registered goal repositories without user interaction.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.