rdiffweb (PyPI)
Advisories
87
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.10.6 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "rdiffweb>=2.10.6"poetry
poetry add "rdiffweb>=2.10.6"uv
uv add "rdiffweb>=2.10.6"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-v4gp-hf5j-4566 IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users |
High EPSS 0.24% |
< 2.10.6 | 2.10.6 |
| GHSA-v4gp-hf5j-4566 IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users |
High EPSS 0.24% |
< 2.10.6 | 2.10.6 |
| GHSA-c4rv-2j6x-pq7x Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 0.78% |
< 2.8.4 | 2.8.4 |
| GHSA-c4rv-2j6x-pq7x Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 0.78% |
< 2.8.4 | 2.8.4 |
| GHSA-wwrg-2w5j-grvx RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling |
Medium EPSS 0.45% |
< 2.8.1 | 2.8.1 |
| GHSA-wwrg-2w5j-grvx RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling |
Medium EPSS 0.45% |
< 2.8.1 | 2.8.1 |
| GHSA-h5wp-jrqc-cwwx rdiffweb vulnerable to Open Redirect |
High EPSS 0.51% |
< 2.5.5 | 2.5.5 |
| GHSA-h5wp-jrqc-cwwx rdiffweb vulnerable to Open Redirect |
High EPSS 0.51% |
< 2.5.5 | 2.5.5 |
| GHSA-2wpw-cm9w-v4xm rdiffweb vulnerable to Business Logic Errors |
Medium EPSS 1.04% |
< 2.5.5 | 2.5.5 |
| GHSA-wf33-6x33-wcf9 rdiffweb vulnerable to Authentication Bypass by Primary Weakness |
High EPSS 1.21% |
< 2.5.5 | 2.5.5 |
| GHSA-wf33-6x33-wcf9 rdiffweb vulnerable to Authentication Bypass by Primary Weakness |
High EPSS 1.21% |
< 2.5.5 | 2.5.5 |
| GHSA-m8r9-qxx8-mrxp rdiffweb Improper Access Control vulnerability |
Critical EPSS 0.88% |
< 2.5.5 | 2.5.5 |
| GHSA-m8r9-qxx8-mrxp rdiffweb Improper Access Control vulnerability |
Critical EPSS 0.88% |
< 2.5.5 | 2.5.5 |
| GHSA-7q4r-x5qg-mmcp rdiffweb has no rate limit on resend email feature |
Medium EPSS 0.67% |
< 2.5.5 | 2.5.5 |
| GHSA-7q4r-x5qg-mmcp rdiffweb has no rate limit on resend email feature |
Medium EPSS 0.67% |
< 2.5.5 | 2.5.5 |
| GHSA-83pm-7v48-5jp4 rdiffweb vulnerable to Special Element Injection |
Medium EPSS 0.52% |
< 2.5.5 | 2.5.5 |
| GHSA-83pm-7v48-5jp4 rdiffweb vulnerable to Special Element Injection |
Medium EPSS 0.52% |
< 2.5.5 | 2.5.5 |
| GHSA-2wpw-cm9w-v4xm rdiffweb vulnerable to Business Logic Errors |
Medium EPSS 1.04% |
< 2.5.5 | 2.5.5 |
| GHSA-85fp-523q-5xwc rdiffweb vulnerable to Cross-Site Request Forgery |
Medium EPSS 0.34% |
< 2.5.4 | 2.5.4 |
| GHSA-85fp-523q-5xwc rdiffweb vulnerable to Cross-Site Request Forgery |
Medium EPSS 0.34% |
< 2.5.4 | 2.5.4 |
| GHSA-639f-hxcv-84mc rdiffweb Open Redirect vulnerability |
Medium EPSS 0.64% |
< 2.5.4 | 2.5.4 |
| GHSA-639f-hxcv-84mc rdiffweb Open Redirect vulnerability |
Medium EPSS 0.64% |
< 2.5.4 | 2.5.4 |
| GHSA-g594-55mp-f6q8 Improper Privilege Management in rdiffweb |
Critical EPSS 0.85% |
< 2.5.2 | 2.5.2 |
| GHSA-g594-55mp-f6q8 Improper Privilege Management in rdiffweb |
Critical EPSS 0.85% |
< 2.5.2 | 2.5.2 |
| GHSA-4wph-9vrm-6v3w Rdiffweb vulnerable to Missing Authentication for Critical Function |
Medium EPSS 0.89% |
< 2.4.11a1 | 2.4.11a1 |
| GHSA-4wph-9vrm-6v3w Rdiffweb vulnerable to Missing Authentication for Critical Function |
Medium EPSS 0.89% |
< 2.5.0a6 | 2.5.0a6 |
| GHSA-94qm-99qc-qwqj rdiffweb vulnerable to Insufficient Session Expiration |
Critical EPSS 0.96% |
< 2.5.0 | 2.5.0 |
| GHSA-94qm-99qc-qwqj rdiffweb vulnerable to Insufficient Session Expiration |
Critical EPSS 0.96% |
< 2.5.0 | 2.5.0 |
| GHSA-jw36-mrvg-j5fx Rdiffweb subject to Business Logic Errors |
Critical EPSS 1.01% |
< 2.5.0a7 | 2.5.0a7 |
| GHSA-jw36-mrvg-j5fx Rdiffweb subject to Business Logic Errors |
Critical EPSS 1.01% |
< 2.5.0 | 2.5.0 |
| GHSA-99j5-fvg3-54pm Rdiffweb is missing authentication for critical function |
Critical EPSS 1.00% |
< 2.4.10 | 2.4.10 |
| GHSA-99j5-fvg3-54pm Rdiffweb is missing authentication for critical function |
Critical EPSS 1.00% |
< 2.5.0 | 2.5.0 |
| GHSA-x8x2-wc2h-wc48 Missing rate limit on rdiffweb |
Critical EPSS 0.83% |
< 2.5.0 | 2.5.0 |
| GHSA-x8x2-wc2h-wc48 Missing rate limit on rdiffweb |
Critical EPSS 0.83% |
< 2.5.0 | 2.5.0 |
| GHSA-92gf-p376-6r9r Missing rate limit on rdiffweb |
Critical EPSS 0.42% |
< 2.5.0 | 2.5.0 |
| GHSA-824x-jcxf-hpfg Origin Validation Error in rdiffweb |
Critical EPSS 0.44% |
< 2.5.0 | 2.5.0 |
| GHSA-824x-jcxf-hpfg Origin Validation Error in rdiffweb |
Critical EPSS 0.44% |
< 2.5.0a5 | 2.5.0a5 |
| GHSA-92gf-p376-6r9r Missing rate limit on rdiffweb |
Critical EPSS 0.42% |
< 2.5.0 | 2.5.0 |
| GHSA-8g9m-vv69-7j99 rdiffweb vulnerable to Open Redirect |
Medium EPSS 0.68% |
< 2.5.0 | 2.5.0 |
| GHSA-8g9m-vv69-7j99 rdiffweb vulnerable to Open Redirect |
Medium EPSS 0.68% |
< 2.5.0a4 | 2.5.0a4 |
| GHSA-hrrm-895h-xh34 rdiffweb Path Traversal vulnerability |
High EPSS 1.40% |
< 2.4.10 | 2.4.10 |
| GHSA-7wr6-fj4x-893v rdiffweb allows a new password to be the same as the previous password |
Medium EPSS 0.85% |
< 2.5.0 | 2.5.0 |
| GHSA-7wr6-fj4x-893v rdiffweb allows a new password to be the same as the previous password |
Medium EPSS 0.85% |
< 2.4.11a1 | 2.4.11a1 |
| GHSA-9g3v-v24q-jj5p rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks |
High EPSS 0.57% |
< 2.5.0 | 2.5.0 |
| GHSA-9g3v-v24q-jj5p rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks |
High EPSS 0.57% |
< 2.4.11a1 | 2.4.11a1 |
| GHSA-hrrm-895h-xh34 rdiffweb Path Traversal vulnerability |
High EPSS 1.40% |
< 2.4.10 | 2.4.10 |
| GHSA-3fhq-72hw-jqwv rdiffweb's lack of token name length limit can result in DoS or memory corruption |
High EPSS 1.34% |
< 2.4.10 | 2.4.10 |
| GHSA-3fhq-72hw-jqwv rdiffweb's lack of token name length limit can result in DoS or memory corruption |
High EPSS 1.34% |
< 2.5.0a3 | 2.5.0a3 |
| GHSA-fqfg-c577-2vc3 rdiffweb's unlimited length Fullname field can lead to DoS |
Medium EPSS 1.18% |
< 2.5.0a3 | 2.5.0a3 |
| GHSA-fqfg-c577-2vc3 rdiffweb's unlimited length Fullname field can lead to DoS |
Medium EPSS 1.18% |
< 2.4.10 | 2.4.10 |
| GHSA-8wxf-c45w-g66g rdiffweb vulnerable to password complexity bypass leading to weak passwords |
Medium EPSS 0.71% |
< 2.4.9 | 2.4.9 |
| GHSA-8wxf-c45w-g66g rdiffweb vulnerable to password complexity bypass leading to weak passwords |
Medium EPSS 0.71% |
< 2.4.9 | 2.4.9 |
| GHSA-7fqm-jm52-f9vc rdiffweb vulnerable to Use of Cache Containing Sensitive Information |
Medium EPSS 0.57% |
< 2.4.9 | 2.4.9 |
| GHSA-7fqm-jm52-f9vc rdiffweb vulnerable to Use of Cache Containing Sensitive Information |
Medium EPSS 0.57% |
< 2.4.8 | 2.4.8 |
| GHSA-xhw9-4wqq-x67v rdiffweb vulnerable to potential DoS via memory consumption |
High EPSS 1.16% |
< 2.4.8 | 2.4.8 |
| GHSA-xhw9-4wqq-x67v rdiffweb vulnerable to potential DoS via memory consumption |
High EPSS 1.16% |
< 2.4.8 | 2.4.8 |
| GHSA-5v95-j4rr-6f3c rdiffweb's unlimited username field length can lead to DoS |
High EPSS 0.89% |
< 2.4.8 | 2.4.8 |
| GHSA-5v95-j4rr-6f3c rdiffweb's unlimited username field length can lead to DoS |
High EPSS 0.89% |
No fix yet | |
| GHSA-5v95-j4rr-6f3c rdiffweb's unlimited username field length can lead to DoS |
High EPSS 0.89% |
< 2.4.8 | 2.4.8 |
| GHSA-qrj3-hrgj-fm7r rdiffweb's unlimited length email field can lead to DoS |
High EPSS 1.77% |
< 2.4.8 | 2.4.8 |
| GHSA-qrj3-hrgj-fm7r rdiffweb's unlimited length email field can lead to DoS |
High EPSS 1.77% |
< 2.4.8 | 2.4.8 |
| GHSA-hrj7-f62f-j7x7 rdiffweb allows unlimited length of root directory name, which could result in DoS |
High EPSS 1.16% |
< 2.4.8 | 2.4.8 |
| GHSA-hrj7-f62f-j7x7 rdiffweb allows unlimited length of root directory name, which could result in DoS |
High EPSS 1.16% |
< 2.4.8 | 2.4.8 |
| GHSA-qq29-5vjh-vxwr rdiffweb vulnerable to Improper Cleanup on Thrown Exception |
Low EPSS 0.69% |
< 2.4.8 | 2.4.8 |
| GHSA-qq29-5vjh-vxwr rdiffweb vulnerable to Improper Cleanup on Thrown Exception |
Low EPSS 0.69% |
< 2.4.8 | 2.4.8 |
| GHSA-j3q4-gmj4-mj95 rdiffweb vulnerable to account access via session fixation |
Critical EPSS 0.92% |
< 2.4.7 | 2.4.7 |
| GHSA-j3q4-gmj4-mj95 rdiffweb vulnerable to account access via session fixation |
Critical EPSS 0.92% |
< 2.4.7 | 2.4.7 |
| GHSA-gmj8-84r4-h46j rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed |
High EPSS 0.50% |
< 2.4.7 | 2.4.7 |
| GHSA-gmj8-84r4-h46j rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed |
High EPSS 0.50% |
< 2.4.7 | 2.4.7 |
| GHSA-74j6-3hh4-w3f5 rdiffweb Cross-Site Request Forgery vulnerability |
Medium EPSS 0.39% |
< 2.4.6 | 2.4.6 |
| GHSA-74j6-3hh4-w3f5 rdiffweb Cross-Site Request Forgery vulnerability |
Medium EPSS 0.39% |
< 2.4.6 | 2.4.6 |
| GHSA-9vxf-mcm6-5m42 rdiffweb CSRF could lead to disabling notifications in user profile |
Medium EPSS 0.39% |
< 2.4.6 | 2.4.6 |
| GHSA-9vxf-mcm6-5m42 rdiffweb CSRF could lead to disabling notifications in user profile |
Medium EPSS 0.39% |
< 2.4.6 | 2.4.6 |
| GHSA-m748-hjqg-rpp8 rdiffweb has insecure HTTP cookies |
Medium EPSS 0.55% |
< 2.4.6 | 2.4.6 |
| GHSA-m748-hjqg-rpp8 rdiffweb has insecure HTTP cookies |
Medium EPSS 0.55% |
< 2.4.6 | 2.4.6 |
| GHSA-cw2v-wv4g-w4p6 rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users |
Medium EPSS 0.40% |
< 2.4.5 | 2.4.5 |
| GHSA-cw2v-wv4g-w4p6 rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users |
Medium EPSS 0.40% |
< 2.4.5 | 2.4.5 |
| GHSA-vq4h-xrwc-m639 rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access |
High EPSS 0.76% |
< 2.4.3 | 2.4.3 |
| GHSA-vq4h-xrwc-m639 rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access |
High EPSS 0.76% |
< 2.4.3 | 2.4.3 |
| GHSA-mp5p-g2jv-r8qw rdiffweb contains Weak Password Requirements |
High EPSS 0.98% |
>= 2.4.1, < 2.4.2 | 2.4.2 |
| GHSA-mp5p-g2jv-r8qw rdiffweb contains Weak Password Requirements |
High EPSS 0.98% |
< 2.4.2 | 2.4.2 |
| GHSA-ch4c-278q-5654 rdiffweb Missing Custom Error Page |
Medium EPSS 0.87% |
< 2.4.2 | 2.4.2 |
| GHSA-mjw4-xvx6-3grg rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
High EPSS 0.71% |
< 2.4.2 | 2.4.2 |
| GHSA-ch4c-278q-5654 rdiffweb Missing Custom Error Page |
Medium EPSS 0.87% |
>= 2.4.1, < 2.4.2 | 2.4.2 |
| GHSA-mjw4-xvx6-3grg rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
High EPSS 0.71% |
>= 2.4.1, < 2.4.2 | 2.4.2 |
| GHSA-m379-x4xc-38x9 rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames |
High EPSS 1.17% |
< 2.4.1 | 2.4.1 |
| GHSA-m379-x4xc-38x9 rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames |
High EPSS 1.17% |
< 2.4.1 | 2.4.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor