CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

Server Side Request Forgery (SSRF)

dtale is vulnerable to Server Side Request Forgery. The vulnerability is due to the Load From the Web configuration being enabled by default. This issue can be exploited by an attacker to access files on the local network resulting in Server Side Request Forgery...

airi-test-task (=0.1.0), dtaledesktop (>=0.0.1 <=0.1.3) +13 more potentially affected by CVE-2024-21642 via dtale (>=2.16.0 <=3.22.0)

dtale PYPI version =2.16.0, =0.0.1, =0.1.0, =0.0.0.35, =0.1.1, =0.0.14, =0.0.5, =0.0.10, =1.0.0, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2024-21642 Source advisory: OSV:GHSA-7HFX-H3J3-RWQ4...

Remote Code Execution (RCE)

Dtale is vulnerable to Remote Code Execution. This vulnerability exists due to the lack of proper validation in the Custom Filter input, which allows an attacker to execute malicious code on the system...

airi-test-task (=0.1.0), dtaledesktop (>=0.0.1 <=0.1.3) +13 more potentially affected by CVE-2023-46134 via dtale (>=2.16.0 <=3.22.0)

dtale PYPI version =2.16.0, =0.0.1, =0.1.0, =0.0.0.35, =0.1.1, =0.0.14, =0.0.5, =0.0.10, =1.0.0, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2023-46134 Source advisory: OSV:GHSA-JQ6C-R9XF-QXJM...