2034 matches found
[ASA-201812-1] jupyter-notebook: cross-site scripting
Arch Linux Security Advisory ASA-201812-1 ========================================= Severity: Medium Date : 2018-12-06 CVE-ID : CVE-2018-19351 CVE-2018-19352 Package : jupyter-notebook Type : cross-site scripting Remote : No Link : https://security.archlinux.org/AVG-820 Summary ======= The packag...
[SECURITY] Fedora 29 Update: python-notebook-5.7.2-1.fc29
The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...
Security Bulletin: IBM i2 Analyst's Notebook. CVE-2018-1527
Summary IBM i2 Analyst's Notebook version 9.0.8 addresses the XML Entity Injection vulnerability detailed in CVE-2018-1527 Vulnerability Details When using any of the import features on IBM i2 Analyst's Notebook Cellebrite, XRY, and Notebook Exchange from the Import menu it is possible to import...
ipynb-path (>=0.1.2, <=0.1.3), jupyter-kernel-gateway (>=0.5.0, <=1.2.2) potentially affected by CVE-2018-19352 via notebook (4.4.1)
notebook PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - ipynb-path =0.1.2, =0.5.0, =1.2.2 Source cves: CVE-2018-19352 Source advisory: OSV:GHSA-3P4Q-X8F3-P7VQ...
vizic (>=0.1.0, <=0.2.0.dev1) potentially affected by CVE-2018-19352 via notebook (4.2.3)
notebook PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - vizic =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-19352 Source advisory: OSV:GHSA-3P4Q-X8F3-P7VQ...
fairing (>=0.0.2, <=0.0.3), hugo-jupyter (>=0.2.1, <=0.3.0) +3 more potentially affected by CVE-2018-19352 via notebook (>=5.0.0, <=5.7.0)
notebook PYPI version =5.0.0, =0.0.2, =0.2.1, =1.0.0, =1.1.2 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2018-19352 Source advisory: GHSA-3P4Q-X8F3-P7VQ...
Jupyter Notebook XSS via directory name
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely...
GHSA-3P4Q-X8F3-P7VQ Jupyter Notebook XSS via directory name
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely...
fairing (>=0.0.2, <=0.0.3), hugo-jupyter (>=0.2.1, <=0.3.0) +3 more potentially affected by CVE-2018-19352 via notebook (>=5.0.0, <=5.7.0)
notebook PYPI version =5.0.0, =0.0.2, =0.2.1, =1.0.0, =1.1.2 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2018-19352 Source advisory: OSV:GHSA-3P4Q-X8F3-P7VQ...
ipynb-path (>=0.1.2, <=0.1.3), jupyter-kernel-gateway (>=0.5.0, <=1.2.2) potentially affected by CVE-2018-19351 via notebook (4.4.1)
notebook PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - ipynb-path =0.1.2, =0.5.0, =1.2.2 Source cves: CVE-2018-19351 Source advisory: OSV:GHSA-49QR-XH3W-H436...
vizic (>=0.1.0, <=0.2.0.dev1) potentially affected by CVE-2018-19351 via notebook (4.2.3)
notebook PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - vizic =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-19351 Source advisory: OSV:GHSA-49QR-XH3W-H436...
Jupyter Notebook XSS via untrusted notebooks
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
fairing (>=0.0.2, <=0.0.3), hugo-jupyter (>=0.2.1, <=0.3.0) +3 more potentially affected by CVE-2018-19351 via notebook (>=5.0.0, <=5.7.0)
notebook PYPI version =5.0.0, =0.0.2, =0.2.1, =1.0.0, =1.1.2 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2018-19351 Source advisory: GHSA-49QR-XH3W-H436...
fairing (>=0.0.2, <=0.0.3), hugo-jupyter (>=0.2.1, <=0.3.0) +3 more potentially affected by CVE-2018-19351 via notebook (>=5.0.0, <=5.7.0)
notebook PYPI version =5.0.0, =0.0.2, =0.2.1, =1.0.0, =1.1.2 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2018-19351 Source advisory: OSV:GHSA-49QR-XH3W-H436...
GHSA-49QR-XH3W-H436 Jupyter Notebook XSS via untrusted notebooks
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
Cross-site Scripting (XSS)
Jupyter notebook is vulnerable to cross-site scripting attacks. The vulnerability exists due to the lack of Content Security Policy CSP value in the HTTP headers, allowing untrusted content from different domains to be loaded and potentially leading to XSS attacks...
Jupyter Notebook Cross-Site Scripting Vulnerability (CNVD-2019-09602)
Jupyter Notebook is an open source web application that creates and shares documents containing live code, equations, visualizations, and narrative text. A cross-site scripting vulnerability exists in Jupyter Notebook versions prior to 5.7.1, which stems from a failure to set the content security...
Jupyter Notebook Cross-Site Scripting Vulnerability (CNVD-2019-09601)
Jupyter Notebook is an open source web application that creates and shares documents containing live code, equations, visualizations, and narrative text. A cross-site scripting vulnerability exists in Jupyter Notebook versions prior to 5.7.2, which stems from a failure to securely handle URLs in...
PYSEC-2018-17
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...