dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47115 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47115 Source advisory: OSV:PYSEC-2024-126...

CVE-2023-47115

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

CVE-2023-47115

CVE-2023-47115 : Label Studio before version 1.9.2 contains an XSS vulnerability via avatar upload. The vulnerability stems from the avatar handling in label_studio/users/functions.py, which only validates that the uploaded file is an image by checking dimensions; it does not securely validate th...

dataops-toolkits (>=0.1.1, <=0.1.2), hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47115 via label-studio (>=0.8.1, <=1.5.0)

label-studio PYPI version =0.8.1, =0.1.1, =0.1.0, =0.2.0 Source cves: CVE-2023-47115 Source advisory: MEND:CVE-2023-47115...

CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

Label Studio Cross-Site Scripting Vulnerability

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats. A cross-site scripting vulnerability exists in Label Studio versio...

Label Studio Cross-Site Scripting Vulnerability

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats. A cross-site scripting vulnerability exists in Label Studio versio...

PT-2024-13407 · Django +1 · Django +1

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.9.2 Description: The issue is a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the...

CVE-2024-23633: Improper Neutralization of Input During Web Page Generation

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

CVE-2023-47115: Improper Neutralization of Input During Web Page Generation

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

GHSA-6HJJ-GQ77-J4QW Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.9.2post0 and was tested on version 1.8.2. Overview In all current versions of Label Studio, the application allow...

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.9.2post0 and was tested on version 1.8.2. Overview In all current versions of Label Studio, the application allow...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47117 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47117 Source advisory: OSV:GHSA-6HJJ-GQ77-J4QW...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47117 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47117 Source advisory: GHSA-6HJJ-GQ77-J4QW...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47117 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-47117 Source advisory: OSV:GHSA-6HJJ-GQ77-J4QW...

Information Disclosure

label Studio is vulnerable to Information Disclosure. This vulnerability exists due to improper sensitive fields restrictions in the the object-relational mapper in serializers.py, allowing an attacker to access and sensitive filters...

CVE-2023-47117

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on t...

Design/Logic Flaw

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on t...

PYSEC-2023-275

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on t...