hugo-jupyter (>=0.2.1, <=0.3.0), mumot (>=1.0.0, <=1.1.2) potentially affected by CVE-2018-21030 via notebook (>=5.0.0, <=5.4.1)

notebook PYPI version =5.0.0, =0.2.1, =1.0.0, =1.1.2 Source cves: CVE-2018-21030 Source advisory: OSV:PYSEC-2019-157...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

vizic (>=0.1.0, <=0.2.0.dev1) potentially affected by CVE-2018-21030 via notebook (4.2.3)

notebook PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - vizic =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-21030 Source advisory: OSV:PYSEC-2019-157...

ipynb-path (>=0.1.2, <=0.1.3), jupyter-kernel-gateway (>=0.5.0, <=1.2.2) potentially affected by CVE-2018-21030 via notebook (4.4.1)

notebook PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - ipynb-path =0.1.2, =0.5.0, =1.2.2 Source cves: CVE-2018-21030 Source advisory: OSV:PYSEC-2019-157...

PYSEC-2019-157

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

UBUNTU-CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

CVE-2018-21030 affects Jupyter Notebook prior to 5.5.0. The issue is that a lack of a Content Security Policy (CSP) header allows cross-origin risks, enabling XSS via SVG documents embedded in served files. The vulnerability is fixed in Jupyter Notebook 5.5.0; upgrade to 5.5.0 or newer to mitigat...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

hugo-jupyter (>=0.2.1, <=0.3.0), ipynb-path (>=0.1.2, <=0.1.3) +3 more potentially affected by CVE-2018-21030 via notebook (>=4.2.3, <=5.4.1)

notebook PYPI version =4.2.3, =0.2.1, =0.1.2, =0.5.0, =1.0.0, =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-21030 Source advisory: MEND:CVE-2018-21030...

CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

CVE-2018-21030: Improper Neutralization of Input During Web Page Generation

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

PT-2019-10457 · Project Jupyter +2 · Jupyter Notebook +2

Name of the Vulnerable Software and Affected Versions: Jupyter Notebook versions prior to 5.5.0 Description: The issue arises from the lack of a Content Security Policy CSP header, which is used to define what sources of content are allowed to be executed within a web page. Without this header,...

August 6, 2019, update for OneNote 2016 (KB4092450)

None None...

Cross-site Scripting (XSS)

invenio-previewer is vulnerable to cross-site scripting XSS. It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim's browser using a malicious file...

Cross-site Scripting in invenio-previewer

Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...

PT-2019-11634

Name of the Vulnerable Software and Affected Versions: invenio-previewer versions prior to 1.0.0a12 Description: A Cross-Site Scripting XSS issue has been found in the JSON, Markdown, and iPython Notebook previewers. This would allow a malicious user to upload a file with embedded scripts that...

Security Bulletin: IBM i2 Intelligent Analyis Platform is affected by a XML External Entity (XXE) vulnerability

Summary IBM i2 Intelligent Analyis Platform has addressed the following vulnerability. XML External Entity vulnerability. This vulnerability allows attackers to exploit the External Entity feature of XML, resulting in the potential for an external party to gain access to sensitive information, or...

Fedora Update for python-notebook FEDORA-2019-9e67979b2a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for python-notebook FEDORA-2018-b792d607fd

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...