carbonify (>=0.1.0, <=0.1.1), unity-cv-datasetvisualizer (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-42474 via streamlit (0.84.1)

streamlit PYPI version 0.84.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - carbonify =0.1.0, =0.0.1, =0.1.2 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

madan (0.1.0), sapsan (>=0.4.4, <=0.5.0) +1 more potentially affected by CVE-2024-42474 via streamlit (0.84.2)

streamlit PYPI version 0.84.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - madan 0.1.0 - sapsan =0.4.4, =0.5.0 - streamlit-pages 0.1.0 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

raylab (>=0.16.0, <=0.16.1), streamlit-azure-ad-login (0.1.0) +1 more potentially affected by CVE-2024-42474 via streamlit (0.85.1)

streamlit PYPI version 0.85.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - raylab =0.16.0, =0.1.0, =2.0.8 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

bubbletea-py (0.0.2), streamlit-kpi-metric (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-42474 via streamlit (0.86.0)

streamlit PYPI version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - bubbletea-py 0.0.2 - streamlit-kpi-metric =0.1.0, =0.1.1 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

bubbletea-py (>=0.0.3, <=0.0.7), ezancestry (>=0.0.1, <=0.0.7) +2 more potentially affected by CVE-2024-42474 via streamlit (0.87.0)

streamlit PYPI version 0.87.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - bubbletea-py =0.0.3, =0.0.1, =0.15.0, =0.15.6 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

alphapept (0.3.29), classy-core (>=0.1.0.dev20211019, <=0.2.0) +3 more potentially affected by CVE-2024-42474 via streamlit (0.88.0)

streamlit PYPI version 0.88.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - alphapept 0.3.29 - classy-core =0.1.0.dev20211019, =0.0.143, =0.4.0, =0.0.3, =0.0.4 Source cves: CVE-2024-42474 Source advisory:...

streamlit-aggrid (0.2.2), streamlit-inspect (0.1.0) potentially affected by CVE-2024-42474 via streamlit (0.89.0)

streamlit PYPI version 0.89.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - streamlit-aggrid 0.2.2 - streamlit-inspect 0.1.0 Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

PYSEC-2024-153

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2024-42474

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

advanced-data-generator (1.0.0), agentbruno (>=0.0.2, <=0.0.5) +170 more potentially affected by CVE-2024-42474 via streamlit (>=1.0.0, <=1.36.0)

streamlit PYPI version =1.0.0, =0.0.2, =1.0.4, =0.8.0, =0.4.1, =1.6.1, =0.2.0, =0.0.7, =0.1.0, =0.1.0, =0.1.72 and more Source cves: CVE-2024-42474 Source advisory: OSV:PYSEC-2024-153...

CVE-2024-42474 Streamlit Path Traversal Security Vulnerability on Windows

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2024-42474 Streamlit Path Traversal Security Vulnerability on Windows

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2024-42474 Streamlit Path Traversal Security Vulnerability on Windows

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2024-42474

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

advanced-data-generator (1.0.0), agentbruno (>=0.0.2, <=0.0.5) +222 more potentially affected by CVE-2024-42474 via streamlit (>=0.6.0, <=1.36.0)

streamlit PYPI version =0.6.0, =0.0.2, =1.0.4, =0.8.0, =0.4.1, =1.6.1, =0.2.0, =0.0.7, =0.0.2, =0.0.3 and more Source cves: CVE-2024-42474 Source advisory: MEND:CVE-2024-42474...

CVE-2024-42474

CVE-2024-42474 affects Streamlit Open Source on Windows via the static file sharing feature, enabling path traversal that could leak the Windows user’s password hash. The issue was identified in Streamlit and patched in version 1.37.0 (released around July 25, 2024). Evidence in connected sources...

CVE-2024-42474: Improper Limitation of a Pathname to a Restricted Directory

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2024-41120

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

CVE-2024-41115

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 488 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 493, leading to remote code executio...

CVE-2024-41117

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 115 in pages/10🌍EarthEngineDatasets.py takes user input, which is later used in the eval function on line 126, leading to remote...