446 matches found
Streamlit-geospatial security vulnerabilities
streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A security vulnerability exists in streamlit-geospatial, which originates in pages/1? The visparams variable in Timelapse.py accepts user input that is then used in the...
PT-2024-29269
Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489 Description The issue arises from user input being taken by the vis params variable, which is later used in the eval function, leading to remote code...
CVE-2024-41113: Improper Input Validation
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 383 or line 390 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 395, leading to remote...
Streamlit-geospatial code issues and vulnerabilities
streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A code issue vulnerability exists in streamlit-geospatial that stems from pages/9? The url variable in VectorDataVisualization.py accepts user input, which is then passed...
GHSA-8QW9-GF7W-42X5 Minor fix to previous patch for CVE-2022-35918
Impact The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific condition...
Minor fix to previous patch for CVE-2022-35918
Impact The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific condition...
advanced-data-generator (1.0.0), agixt (1.2.3) +173 more potentially affected by unknown CVE via streamlit (>=0.63.1, <=1.29.0)
streamlit PYPI version =0.63.1, =0.8.0, =0.4.1, =1.7.0, =0.2.0, =0.0.2, =0.1.0, =0.5.0, =0.1.0, =1.2.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8QW9-GF7W-42X5...
advanced-data-generator (1.0.0), agixt (1.2.3) +173 more potentially affected by CVE-2022-35918 via streamlit (>=0.63.1, <=1.29.0)
streamlit PYPI version =0.63.1, =0.8.0, =0.4.1, =1.7.0, =0.2.0, =0.0.2, =0.1.0, =0.5.0, =0.1.0, =1.2.2 and more Source cves: CVE-2022-35918 Source advisory: GHSA-8QW9-GF7W-42X5...
PT-2024-40201 · Streamlit · Streamlit
Name of the Vulnerable Software and Affected Versions: Streamlit versions prior to 1.30.0 Streamlit versions prior to 1.11.1 are also affected, but the issue was partially addressed in version 1.11.1 Description: The issue allows for directory traversal attacks, potentially exposing certain files...
Streamlit publishes previously-patched Cross-site Scripting vulnerability
Synopsis: Streamlit open source publicizes a prior security fix implemented in 2021. The vulnerability affected Streamlit versions between 0.63.0 and 0.80.0 inclusive and was patched on April 21, 2021. If you are using Streamlit with version before 0.63.0 or after 0.80.0, no action is required. 1...
augbuilder (>=0.0.2, <=0.0.3), hlm-texts (0.1.2) +16 more potentially affected by CVE-2023-27494 via streamlit (>=0.63.1, <=0.80.0)
streamlit PYPI version =0.63.1, =0.0.2, =0.0.2, =0.0.1rc1, =0.1.12, =0.32.0.dev5, =0.10.8, =2.4.30, =0.1.0, =0.0.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-27494 Source advisory: OSV:GHSA-9C6G-QPGJ-RVXW...
augbuilder (>=0.0.2, <=0.0.3), hlm-texts (0.1.2) +16 more potentially affected by CVE-2023-27494 via streamlit (>=0.63.1, <=0.80.0)
streamlit PYPI version =0.63.1, =0.0.2, =0.0.2, =0.0.1rc1, =0.1.12, =0.32.0.dev5, =0.10.8, =2.4.30, =0.1.0, =0.0.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-27494 Source advisory: GHSA-9C6G-QPGJ-RVXW...
GHSA-9C6G-QPGJ-RVXW Streamlit publishes previously-patched Cross-site Scripting vulnerability
Synopsis: Streamlit open source publicizes a prior security fix implemented in 2021. The vulnerability affected Streamlit versions between 0.63.0 and 0.80.0 inclusive and was patched on April 21, 2021. If you are using Streamlit with version before 0.63.0 or after 0.80.0, no action is required. 1...
CVE-2023-27494
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
Cross site scripting
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
augbuilder (>=0.0.2, <=0.0.3), hlm-texts (0.1.2) +16 more potentially affected by CVE-2023-27494 via streamlit (>=0.63.1, <=0.80.0)
streamlit PYPI version =0.63.1, =0.0.2, =0.0.2, =0.0.1rc1, =0.1.12, =0.32.0.dev5, =0.10.8, =2.4.30, =0.1.0, =0.0.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-27494 Source advisory: OSV:PYSEC-2023-50...
PYSEC-2023-50
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
PYSEC-2023-50
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
CVE-2023-27494 Streamlit Cross-site Scripting vulnerability
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
CVE-2023-27494 Streamlit Cross-site Scripting vulnerability
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...