Vulnerabilities > Python > Python > 3.7.4

DATE CVE VULNERABILITY TITLE RISK
2020-01-28 CVE-2020-8315 Improper Input Validation vulnerability in Python
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy.
network
python CWE-20
4.3
4.3
2019-10-23 CVE-2019-18348 Injection vulnerability in Python
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
network
low complexity
python CWE-74
6.1
6.1
2019-09-28 CVE-2019-16935 Cross-site Scripting vulnerability in multiple products
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.
network
low complexity
python debian canonical CWE-79
6.1
6.1
2019-09-06 CVE-2019-16056 An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. 7.5
7.5
2019-09-04 CVE-2019-15903 XML Entity Expansion vulnerability in multiple products
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
network
low complexity
libexpat-project python CWE-776
7.5
7.5
2019-06-19 CVE-2019-12900 Out-of-bounds Write vulnerability in multiple products
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
network
low complexity
bzip debian opensuse canonical freebsd python CWE-787
critical
 9.8
9.8
2019-03-23 CVE-2019-9948 Path Traversal vulnerability in multiple products
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
network
low complexity
python opensuse debian fedoraproject canonical redhat CWE-22
critical
 9.1
9.1
2019-03-23 CVE-2019-9947 CRLF Injection vulnerability in Python
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
network
low complexity
python CWE-93
6.1
6.1
2019-03-13 CVE-2019-9740 CRLF Injection vulnerability in Python
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
network
low complexity
python CWE-93
6.1
6.1
2016-06-30 CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
network
low complexity
bzip python
6.5
6.5