45 matches found
编号撤回
dtale is a pandas data structure visualization tool from Man Open Source. This CVE number has been withdrawn...
PT-2025-12319 · Man · D-Tale
Name of the Vulnerable Software and Affected Versions: man-group/dtale version 3.15.1 Description: A vulnerability in man-group/dtale allows an attacker to override global state settings to enable the enable custom filters feature, which is typically restricted to trusted environments. Once...
编号撤回
dtale is a pandas data structure visualization tool from Man Open Source. This CVE number has been withdrawn...
Cross-site Scripting (XSS)
Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Cross-site Scripting XSS through the update-settings endpoint, allowing an attacker to use enablecustomfilters to specify custom filters will be used for exploitation of this...
intelligenzaartificiale (>=0.0.0.35 <=0.0.0.38), nexus-corr-discovery (=0.0.1.post2) +1 more potentially affected by CVE-2024-55890 via dtale (>=2.16.0 <=3.12.0)
dtale PYPI version =2.16.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-55890 Source advisory: OSV:GHSA-832W-FHMW-W4F4...
nexus-corr-discovery (=0.0.1.post2) potentially affected by CVE-2024-55890 via dtale (=3.12.0)
dtale PYPI version =3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery =0.0.1.post2 Source cves: CVE-2024-55890 Source advisory: SNYK:PYTHON-DTALE-8515878...
Remote Code Execution
dtale is vulnerable to Remote Code Execution RCE via the runquery function. The vulnerability is due to improper sanitization of the query parameter. An attacker can execute arbitrary code on the server by sending malicious input...
intelligenzaartificiale (>=0.0.0.35 <=0.0.0.38), nexus-corr-discovery (=0.0.1.post2) +1 more potentially affected by CVE-2024-8862 via dtale (>=2.16.0 <=3.12.0)
dtale PYPI version =2.16.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-8862 Source advisory: OSV:GHSA-FG5M-M723-7MV6...
Remote Code Execution (RCE)
dtale is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling or validation of user input in the "Custom Filter" feature using the getstrarg method, allowing malicious code to be executed on the server...
intelligenzaartificiale (>=0.0.0.35 <=0.0.0.38), nexus-corr-discovery (=0.0.1.post2) +1 more potentially affected by CVE-2024-45595 via dtale (>=2.16.0 <=3.12.0)
dtale PYPI version =2.16.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-45595 Source advisory: OSV:GHSA-PW44-4H99-WQFF...
Authentication Bypass / Remote Code Execution (RCE)
dtale is vulnerable to Authentication Bypass / Remote Code Execution RCE. The vulnerability is due to improper input validation and the presence of a hardcoded SECRETKEY in the Flask configuration, allowing attackers to forge a session cookie. Additionally, there is improper validation of custom...
intelligenzaartificiale (>=0.0.0.35 <=0.0.0.38), trt-engine-explorer (>=0.1.0 <=0.1.5) potentially affected by CVE-2024-3408 via dtale (>=2.16.0 <=2.2.0)
dtale PYPI version =2.16.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-3408 Source advisory: OSV:GHSA-V9Q6-FM48-RX74...
GHSA-V9Q6-FM48-RX74 Authentication bypass in dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
nexus-corr-discovery (=0.0.1.post2) potentially affected by CVE-2024-3408 via dtale (=3.12.0)
dtale PYPI version =3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery =0.0.1.post2 Source cves: CVE-2024-3408 Source advisory: OSV:PYSEC-2024-117...
trt-engine-explorer (>=0.1.2 <=0.1.5) potentially affected by CVE-2024-3408 via dtale (=2.16.0)
dtale PYPI version =2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-3408 Source advisory: OSV:PYSEC-2024-117...
PYSEC-2024-117
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
PYSEC-2024-117
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-3408
CVE-2024-3408 (DTale) affects man-group/dtale 3.10.0 up to 3.15.1. Root causes: (1) hardcoded SECRET_KEY in Flask config enabling session forgery; (2) improper input validation that allows bypass of authentication and arbitrary code execution via the /dtale/update-settings and /dtale/test-filter ...