devel/ipython -- multiple vulnerabilities

ID 290351C9-6F5C-11E5-A2A1-002590263BF5
Type freebsd
Reporter FreeBSD
Modified 2015-09-01T00:00:00


Matthias Bussonnier reports:

Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it. URI with issues:

GET /tree/**

Benjamin RK reports:

Vulnerability: A maliciously forged file opened for editing can execute javascript, specifically by being redirected to /files/ due to a failure to treat the file as plain text. URI with issues:

GET /edit/**