Search for packages
| purl | pkg:pypi/trytond@4.2.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-kjnf-nmzs-c7b5
Aliases: CVE-2019-10868 GHSA-f6f2-pwrj-64h3 PYSEC-2019-127 |
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ye2t-2sf7-6fd6 | file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242. |
CVE-2017-0360
GHSA-7cwg-2575-3546 PYSEC-2017-97 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:42:41.023641+00:00 | GitLab Importer | Fixing | VCID-ye2t-2sf7-6fd6 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/trytond/CVE-2017-0360.yml | 38.6.0 |
| 2026-06-02T04:05:35.949547+00:00 | Pypa Importer | Affected by | VCID-kjnf-nmzs-c7b5 | https://github.com/pypa/advisory-database/blob/main/vulns/trytond/PYSEC-2019-127.yaml | 38.6.0 |
| 2026-06-02T04:04:37.442786+00:00 | Pypa Importer | Fixing | VCID-ye2t-2sf7-6fd6 | https://github.com/pypa/advisory-database/blob/main/vulns/trytond/PYSEC-2017-97.yaml | 38.6.0 |