CVE-2021-42952

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services...

CVE-2021-42952

Affected product: Zepl Notebooks. The CVE-2021-42952 entry describes a sandbox-escape flaw that enables Remote Code Execution from a Notebook to escape the sandbox and access internal Zepl assets, including cloud metadata services, effectively compromising cloud assets. The vulnerability affects ...

GitLab Enterprise Edition和GitLab Community Edition 跨站请求伪造漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. GitLab Enterprise Edition and Gitlab Community Edition are vulnerable to a cross-site request forgery vulnerability that arises from insufficient handling of...

CVE-2021-29867

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212...

CVE-2021-29867

The CVE-2021-29867 vulnerability affects IBM Cognos Analytics 11.1.7 and 11.2.0, where an authenticated user could view or edit a Jupyter notebook they should not access. Root cause details aren’t explicitly stated in the provided documents, but the NVD entry lists a CVSS v3.1 base score of 5.4 (...

IBM Cognos Analytics 安全漏洞

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation of the United States. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing content such as key factors and key people. IBM Cognos Analytic...

Join us at InfoSec Jupyterthon 2021

We’re excited to invite our community of infosec analysts and engineers to the second annual InfoSec Jupyterthon taking place on December 2-3, 2021. This is an online event organized by our friends in the Open Threat Research Forge, together with folks from the Microsoft Threat Intelligence Cente...

Msticpy - Microsoft Threat Intelligence Security Tools

Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations and Azure resource data extract Indicator...

CVE-2021-3786

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range...

CVE-2021-3786

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range...

CVE-2021-41247

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials for the single-user server only, not the Hub reinstated...

PYSEC-2021-386

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials for the single-user server only, not the Hub reinstated...

CVE-2021-41247

CVE-2021-41247 affects JupyterHub, where users with multiple JupyterLab tabs in a single browser session may experience incomplete logout from the single-user server, as fresh credentials are reinstated if another active JupyterLab session remains open during logout. The issue is mitigated by upg...

CVE-2021-41134

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting XSS issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs...

PYSEC-2021-428

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting XSS issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs...

Cross site scripting

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting XSS issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs...

PYSEC-2021-428

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting XSS issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs...

CVE-2021-41134

The CVE-2021-41134 issue affects the nbdime project (diffNotebookCheckpoint) used for diffing/merging Jupyter Notebooks. A stored XSS vulnerability arises when reading the local notebook name: the code appends .ipynb to the input name, builds the base string for the NbdimeWidget, and renders it i...

PYSEC-2021-130

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

PT-2021-6459 · Unknown +1 · Jupyter Notebook +1

Name of the Vulnerable Software and Affected Versions: Jupyter Notebook versions prior to 5.7.11 Jupyter Notebook versions prior to 6.4.1 Description: The issue is related to the incorrect filtering of special symbols in the Caja component of the Jupyter Notebook environment, allowing a remote...