pydisconet (=0.1.0) potentially affected by CVE-2024-35225 via jupyter-server-proxy (=4.1.0)

jupyter-server-proxy PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server-proxy and may be impacted: - pydisconet =0.1.0 Source cves: CVE-2024-35225 Source advisory: OSV:GHSA-FVCQ-4X64-HQXR...

lftakakura-mage-ai (=0.9.37a1), mage-ai (>=0.0.6 <=0.9.72) potentially affected by CVE-2024-35225 via jupyter-server-proxy (>=3.2.1 <=3.2.3)

jupyter-server-proxy PYPI version =3.2.1, =0.0.6, =0.9.72 Source cves: CVE-2024-35225 Source advisory: OSV:GHSA-FVCQ-4X64-HQXR...

Jupyter Server Proxy has a reflected XSS issue in host parameter

Impact There is a reflected cross-site scripting XSS issue in jupyter-server-proxy1. The /proxy endpoint accepts a host path segment in the format /proxy/. When this endpoint is called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host, withou...

GHSA-FVCQ-4X64-HQXR Jupyter Server Proxy has a reflected XSS issue in host parameter

Impact There is a reflected cross-site scripting XSS issue in jupyter-server-proxy1. The /proxy endpoint accepts a host path segment in the format /proxy/. When this endpoint is called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host, withou...

Jupyter Server Proxy Security Vulnerability

Jupyter Server Proxy is an open source library from JupyterHub that allows arbitrary external processes to be run alongside a laptop server. A security vulnerability exists in Jupyter Server Proxy prior to 3.2.4, versions prior to 4.2.0, which stems from a vulnerability that allows users to run...

The vulnerability of the Jupyter Server Proxy software, a tool for launching and proxying web applications, stems from the lack of authentication for a critical function. This allows attackers to execute arbitrary code.

The vulnerability of the Jupyter Server Proxy software for launching and proxying web applications is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Missing Websocket Authentication

Jupyter Server Proxy is vulnerable to Missing Websocket Authentication. The vulnerability is caused due to improper user authentication checks when proxying websockets within handlers.py. This allows an attacker to gain unauthenticated remote access to any websocket endpoint made accessible via t...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

pydisconet (=0.1.0) potentially affected by CVE-2024-28179 via jupyter-server-proxy (=4.1.0)

jupyter-server-proxy PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server-proxy and may be impacted: - pydisconet =0.1.0 Source cves: CVE-2024-28179 Source advisory: OSV:PYSEC-2024-234...

grid2viz (>=1.1.0 <=1.3.1), lftakakura-mage-ai (=0.9.37a1) +2 more potentially affected by CVE-2024-28179 via jupyter-server-proxy (>=1.3.2 <=3.2.1)

jupyter-server-proxy PYPI version =1.3.2, =1.1.0, =0.0.6, =0.1.4, =0.2.1 Source cves: CVE-2024-28179 Source advisory: OSV:PYSEC-2024-234...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

grid2viz (>=1.1.0 <=1.3.1), lftakakura-mage-ai (=0.9.37a1) +2 more potentially affected by CVE-2024-28179 via jupyter-server-proxy (>=1.3.2 <=3.2.1)

jupyter-server-proxy PYPI version =1.3.2, =1.1.0, =0.0.6, =0.1.4, =0.2.1 Source cves: CVE-2024-28179 Source advisory: OSV:GHSA-W3VC-FX9P-WP4V...

pydisconet (=0.1.0) potentially affected by CVE-2024-28179 via jupyter-server-proxy (=4.1.0)

jupyter-server-proxy PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server-proxy and may be impacted: - pydisconet =0.1.0 Source cves: CVE-2024-28179 Source advisory: OSV:GHSA-W3VC-FX9P-WP4V...

Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...

GHSA-W3VC-FX9P-WP4V Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...