dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-core-components (2.0.0rc1)

dash-core-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory: GHSA-547X-748V-VP...

buzzword (>=1.2.1, <=1.2.3) potentially affected by CVE-2024-21485 via dash-core-components (1.1.1)

dash-core-components PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - buzzword =1.2.1, =1.2.3 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-core-components (2.0.0rc1)

dash-core-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

dragg (0.0.0), dragg-gym (0.0.1) +6 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.3)

dash-html-components PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - simba-uw-no-tf =1.2.9.2, =0.70.0, =0.10.0, =0.1.0, =0.11.1, =0.15.1 Source cves:...

dragg (0.0.0), dragg-gym (0.0.1) potentially affected by CVE-2024-21485 via dash-core-components (1.9.1)

dash-core-components PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

dash-tokamak (1.6.0) potentially affected by CVE-2024-21485 via dash-core-components (1.5.0)

dash-core-components PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dash-tokamak 1.6.0 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

Cross site scripting

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

PYSEC-2024-35

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

buzzword (>=1.2.1, <=1.2.3), dash (2.0.0rc3) +20 more potentially affected by CVE-2024-21485 via dash-html-components (>=0.10.0, <=2.0.0rc1)

dash-html-components PYPI version =0.10.0, =1.2.1, =0.1.0, =2.0.0b0, =0.1.0, =0.0.2, =1.1.0, =1.0.0.dev9, =1.0.2 and more Source cves: CVE-2024-21485 Source advisory: MEND:CVE-2024-21485...

CVE-2024-21485

Dash Framework (Dash, dash-core-components, dash-html-components) versions before 2.15.0 (core components before 2.13.0/2.0.0; html components before 2.0.0/2.0.16) are vulnerable to Cross-site Scripting (XSS) when the href attribute of an anchor tag is controlled by an attacker. The vulnerability...

buzzword (>=1.2.1, <=1.2.3), dash (2.0.0rc3) +22 more potentially affected by CVE-2024-21485 via dash-core-components (>=0.22.1, <=2.0.0rc1)

dash-core-components PYPI version =0.22.1, =1.2.1, =0.1.0, =2.0.0b0, =0.1.0, =0.1.0, =0.2.0, =0.0.2, =0.1.13 and more Source cves: CVE-2024-21485 Source advisory: MEND:CVE-2024-21485...

CVE-2024-21485: Improper Neutralization of Input During Web Page Generation

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-core-components (2.0.0rc1)

dash-core-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

Cross-site Scripting (XSS)

Overview dash-core-components is a library that provides the core React component suite for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this...

Cross-site Scripting (XSS)

Overview dash-html-components is a Vanilla HTML components for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the...