117 matches found
Cross-site Scripting (XSS)
Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Cross-site Scripting XSS through the update-settings endpoint, allowing an attacker to use enablecustomfilters to specify custom filters will be used for exploitation of this...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), nexus-corr-discovery (0.0.1.post2) +1 more potentially affected by CVE-2024-55890 via dtale (>=2.2.0, <=3.12.0)
dtale PYPI version =2.2.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-55890 Source advisory: MEND:CVE-2024-55890...
Remote Code Execution
dtale is vulnerable to Remote Code Execution RCE via the runquery function. The vulnerability is due to improper sanitization of the query parameter. An attacker can execute arbitrary code on the server by sending malicious input...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-8862 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-8862 Source advisory: OSV:GHSA-FG5M-M723-7MV6...
nexus-corr-discovery (0.0.1.post2) potentially affected by CVE-2024-8862 via dtale (3.12.0)
dtale PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery 0.0.1.post2 Source cves: CVE-2024-8862 Source advisory: GHSA-FG5M-M723-7MV6...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-8862 via dtale (2.2.0)
dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-8862 Source advisory: OSV:GHSA-FG5M-M723-7MV6...
nexus-corr-discovery (0.0.1.post2) potentially affected by CVE-2024-8862 via dtale (3.12.0)
dtale PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery 0.0.1.post2 Source cves: CVE-2024-8862 Source advisory: OSV:GHSA-FG5M-M723-7MV6...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), nexus-corr-discovery (0.0.1.post2) +1 more potentially affected by CVE-2024-8862 via dtale (>=2.2.0, <=3.12.0)
dtale PYPI version =2.2.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-8862 Source advisory: MEND:CVE-2024-8862...
Remote Code Execution (RCE)
dtale is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling or validation of user input in the "Custom Filter" feature using the getstrarg method, allowing malicious code to be executed on the server...
nexus-corr-discovery (0.0.1.post2) potentially affected by CVE-2024-45595 via dtale (3.12.0)
dtale PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery 0.0.1.post2 Source cves: CVE-2024-45595 Source advisory: OSV:GHSA-PW44-4H99-WQFF...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-45595 via dtale (2.2.0)
dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-45595 Source advisory: OSV:GHSA-PW44-4H99-WQFF...
nexus-corr-discovery (0.0.1.post2) potentially affected by CVE-2024-45595 via dtale (3.12.0)
dtale PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - nexus-corr-discovery 0.0.1.post2 Source cves: CVE-2024-45595 Source advisory: GHSA-PW44-4H99-WQFF...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-45595 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-45595 Source advisory: OSV:GHSA-PW44-4H99-WQFF...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), nexus-corr-discovery (0.0.1.post2) +1 more potentially affected by CVE-2024-45595 via dtale (>=2.2.0, <=3.12.0)
dtale PYPI version =2.2.0, =0.0.0.35, =0.1.0, =0.1.5 Source cves: CVE-2024-45595 Source advisory: MEND:CVE-2024-45595...
Authentication Bypass / Remote Code Execution (RCE)
dtale is vulnerable to Authentication Bypass / Remote Code Execution RCE. The vulnerability is due to improper input validation and the presence of a hardcoded SECRETKEY in the Flask configuration, allowing attackers to forge a session cookie. Additionally, there is improper validation of custom...
GHSA-V9Q6-FM48-RX74 Authentication bypass in dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-3408 via dtale (2.2.0)
dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-3408 Source advisory: OSV:GHSA-V9Q6-FM48-RX74...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-3408 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-3408 Source advisory: OSV:GHSA-V9Q6-FM48-RX74...
PYSEC-2024-117
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-3408 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-3408 Source advisory: OSV:PYSEC-2024-117...