dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-43791 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-43791 Source advisory: GHSA-F475-X83M-RX5M...

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability was found to affect versions before 1.8.2, where a patch was introduced. Overview In Label Studio version 1.8.1, a hard coded Django SECRETKEY was set in the...

GHSA-F475-X83M-RX5M Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability was found to affect versions before 1.8.2, where a patch was introduced. Overview In Label Studio version 1.8.1, a hard coded Django SECRETKEY was set in the...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-43791 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-43791 Source advisory: OSV:GHSA-F475-X83M-RX5M...

CVE-2023-43791

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges...

dataops-toolkits (>=0.1.1, <=0.1.2), hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-43791 via label-studio (>=0.8.1, <=1.5.0)

label-studio PYPI version =0.8.1, =0.1.1, =0.1.0, =0.2.0 Source cves: CVE-2023-43791 Source advisory: MEND:CVE-2023-43791...

CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges...

CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges...

CVE-2023-43791

Label Studio (before 1.8.2) is affected by an ORM Leak chain that can impersonate any account, enabling privilege escalation to a Django Super Administrator. A patch was introduced in 1.8.2. Public references describe a hard-coded SECRET_KEY vulnerability and a follow-on exploit path that leverag...

CVE-2023-43791: Exposure of Sensitive Information to an Unauthorized Actor

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges...

PT-2023-28983

Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.8.2 Description There is a vulnerability in Label Studio that can be chained with an Object Relational Mapper ORM Leak vulnerability to impersonate any account on the platform. An attacker could exploit these...

Label Studio Security Vulnerability

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats. A security vulnerability exists in Label Studio versions prior to...

CVE-2023-43791

creationtimestamp| type| source ---|---|--- 2023-11-08 20:48:10+00:00| published-proof-of-concept| https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5m...

WS-2023-0080

The vulnerability resides on the Nginx config file: https://github.com/heartexlabs/label-studio/blob/53944e6bcede75ca5c102d655013f2e5238e85e6/deploy/default.confL119 The pattern on location /static indicates a popular misconfiguration on Nginx servers presented in 2018 originally by Orange Tsai...

Label Studio 1.5.0 - Authenticated Server Side Request Forgery Vulnerability

Exploit Title: Label Studio 1.5.0 - Authenticated Server Side Request Forgery SSRF Google Dork: intitle:"Label Studio" intext:"Sign Up" intext:"Welcome to Label Studio Community Edition" Date: 2022-10-03 Exploit Author: @DeveloperNinja, email protected Vendor Homepage:...

Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)

Exploit Title: Label Studio 1.5.0 - Authenticated Server Side Request Forgery SSRF Google Dork: intitle:"Label Studio" intext:"Sign Up" intext:"Welcome to Label Studio Community Edition" Date: 2022-10-03 Exploit Author: @DeveloperNinja, [email protected] Vendor Homepage:...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-CPMR-MW4J-99R7...

Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/

Summary The vulnerability resides on the Nginx config file: https://github.com/heartexlabs/label-studio/blob/53944e6bcede75ca5c102d655013f2e5238e85e6/deploy/default.confL119 The pattern on location /static indicates a popular misconfiguration on Nginx servers presented in 2018 originally by Orang...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: GHSA-CPMR-MW4J-99R7...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by unknown CVE via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-CPMR-MW4J-99R7...