Security Bulletin: JWT Token Check Vulnerability in Watson Studio Local

Summary An error in how JWT token signature was checked has been addressed. This issue was leading to invalid Jupyter Notebook access. Vulnerability Details Third Party Entry: PSIRT-ADV0010959 DESCRIPTION: CVSS Base score: 5.9 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected...

CVE-2019-19235

AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 for Windows 10 notebook PCs could lead to unsigned code execution with no additional execution. The user must put an application at a particular path, with a particular file name...

GHSA-JQWC-JM56-WCWJ Cross-site scripting in Jupyter Notebook

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

Cross-site scripting in Jupyter Notebook

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

DEBIAN-CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

PYSEC-2019-157

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

PYSEC-2019-157

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

Cross site scripting

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

UBUNTU-CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

CVE-2018-21030 affects Jupyter Notebook prior to 5.5.0. The issue is that a lack of a Content Security Policy (CSP) header allows cross-origin risks, enabling XSS via SVG documents embedded in served files. The vulnerability is fixed in Jupyter Notebook 5.5.0; upgrade to 5.5.0 or newer to mitigat...

CVE-2018-21030: Improper Neutralization of Input During Web Page Generation

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

PT-2019-10457 · Project Jupyter +2 · Jupyter Notebook +2

Name of the Vulnerable Software and Affected Versions: Jupyter Notebook versions prior to 5.5.0 Description: The issue arises from the lack of a Content Security Policy CSP header, which is used to define what sources of content are allowed to be executed within a web page. Without this header,...

August 6, 2019, update for OneNote 2016 (KB4092450)

None None...

Cross-site Scripting (XSS)

invenio-previewer is vulnerable to cross-site scripting XSS. It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim's browser using a malicious file...

Cross-site Scripting in invenio-previewer

Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...