PT-2024-21666 · Mlflow · Mlflow

The issue is with MLflow, which has a problem with insufficient sanitization, leading to XSS when running a recipe that uses an untrusted dataset. This can further result in a client-side RCE when the recipe is run in Jupyter Notebook. The affected software is MLflow, and the issue arises from a...

Ubuntu 'command-not-found' Tool Could Trick Users into Installing Rogue Packages

Cybersecurity researchers have found that it's possible for threat actors to exploit a well-known utility called command-not-found to recommend their own rogue packages and compromise systems running Ubuntu operating system. "While 'command-not-found' serves as a convenient tool for suggesting...

[SECURITY] Fedora 39 Update: jupyterlab-4.0.11-1.fc39

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface...

[SECURITY] Fedora 39 Update: python-notebook-7.0.7-1.fc39

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

Fedora 39 : jupyterlab / python-notebook (2024-1673c2696e)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-1673c2696e advisory. Update of jupyterlab and notebook including fix for CVE-2024-22420 . Tenable has extracted the preceding description block directly from the Fedora...

Fedora: Security Advisory for python-notebook (FEDORA-2024-1673c2696e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...

CVE-2024-22421 Potential authentication and CSRF tokens leak in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...

CVE-2024-22421 Potential authentication and CSRF tokens leak in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...

CVE-2024-22421

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...

CVE-2024-22421

CVE-2024-22421 affects JupyterLab and relates to a redirect vulnerability in older jupyter-server versions. If a user clicks a malicious link, their Authorization and XSRFToken can be exposed to a third party when running vulnerable jupyter-server. Affected JupyterLab releases are 4.1.0b2, 4.0.11...

alactions (>=0.0.7 <=0.0.11), ale-uy (=1.5.0) +36 more potentially affected by CVE-2024-22421 via notebook (>=7.0.0 <=7.0.6)

notebook PYPI version =7.0.0, =0.0.7, =1.0.1, =0.0.1, =0.20.0, =0.0.1, =0.1.1, =0.2.0, =1.6.0, =1.16.0, =1.18.0.post1 - lp-aicloud =4.0.0 and more Source cves: CVE-2024-22421 Source advisory: OSV:GHSA-44CC-43RP-5947...

alactions (>=0.0.7 <=0.0.11), ale-uy (=1.5.0) +36 more potentially affected by CVE-2024-22420 via notebook (>=7.0.0 <=7.0.6)

notebook PYPI version =7.0.0, =0.0.7, =1.0.1, =0.0.1, =0.20.0, =0.0.1, =0.1.1, =0.2.0, =1.6.0, =1.16.0, =1.18.0.post1 - lp-aicloud =4.0.0 and more Source cves: CVE-2024-22420 Source advisory: OSV:GHSA-4M77-CMPX-VJC4...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

Design/Logic Flaw

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

Jupyter Notebook Viewer Security Vulnerability

Jupyter Notebook Viewer is a macOS application for viewing Jupyter/IPython notebooks. A security vulnerability exists in Jupyter Notebook Viewer prior to version 0.1.6, which stems from a problem with the get-task-allow function and can be exploited by an attacker to load untrusted code...

CVE-2023-51277

CVE-2023-51277 affects nbviewer-app (Jupyter Notebook Viewer) prior to version 0.1.6, where the release build incorrectly included the get-task-allow entitlement. This misconfiguration can enable loading of untrusted code, with reported high impact on confidentiality, integrity, and availability....