trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-3408 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-3408 Source advisory: OSV:PYSEC-2024-117...

nexus-corr-discovery (0.0.1.post2) potentially affected by CVE-2024-3408 via dtale (3.12.0)

dtale PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery 0.0.1.post2 Source cves: CVE-2024-3408 Source advisory: OSV:PYSEC-2024-117...

airi-test-task (0.1.0), dtaledesktop (>=0.0.1, <=0.1.3) +9 more potentially affected by CVE-2024-3408 via dtale (3.22.0)

dtale PYPI version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - airi-test-task 0.1.0 - dtaledesktop =0.0.1, =0.1.0, =0.1.1, =0.0.14, =0.0.5, =0.0.10, =1.0.0, =0.3.3, =0.3.15 Source cves: CVE-2024-3408 Source...

PYSEC-2024-117

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

CVE-2024-3408

CVE-2024-3408 (DTale) affects man-group/dtale 3.10.0 up to 3.15.1. Root causes: (1) hardcoded SECRET_KEY in Flask config enabling session forgery; (2) improper input validation that allows bypass of authentication and arbitrary code execution via the /dtale/update-settings and /dtale/test-filter ...

CVE-2024-3408

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded "SECRETKEY" in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

CVE-2024-3408: Use of Hard-coded Credentials

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

Server Side Request Forgery (SSRF)

dtale is vulnerable to Server Side Request Forgery. The vulnerability is due to the Load From the Web configuration being enabled by default. This issue can be exploited by an attacker to access files on the local network resulting in Server Side Request Forgery...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-21642 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-21642 Source advisory: OSV:GHSA-7HFX-H3J3-RWQ4...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-21642 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-21642 Source advisory: OSV:GHSA-7HFX-H3J3-RWQ4...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.5) potentially affected by CVE-2024-21642 via dtale (>=2.2.0, <=2.16.0)

dtale PYPI version =2.2.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-21642 Source advisory: MEND:CVE-2024-21642...

Remote Code Execution (RCE)

Dtale is vulnerable to Remote Code Execution. This vulnerability exists due to the lack of proper validation in the Custom Filter input, which allows an attacker to execute malicious code on the system...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.5) potentially affected by CVE-2023-46134 via dtale (>=2.2.0, <=2.16.0)

dtale PYPI version =2.2.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2023-46134 Source advisory: MEND:CVE-2023-46134...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-46134 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2023-46134 Source advisory: OSV:GHSA-JQ6C-R9XF-QXJM...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2023-46134 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2023-46134 Source advisory: OSV:GHSA-JQ6C-R9XF-QXJM...