279 matches found
Improper access control
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users who have coding permissions to read and overwrite notebooks in projects that they are not authorized to access...
CVE-2021-27225
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users who have coding permissions to read and overwrite notebooks in projects that they are not authorized to access...
CVE-2021-27225
CVE-2021-27225 affects Dataiku DSS prior to 8.0.6. The issue is insufficient access control in the Jupyter notebooks integration, allowing users with coding permissions to read and overwrite notebooks in projects they are not authorized to access. This is documented across multiple sources (NVD/R...
CVE-2021-27225
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users who have coding permissions to read and overwrite notebooks in projects that they are not authorized to access...
Dataiku Jupyter 访问控制错误漏洞
Dataiku Jupyter is a Dataiku open source application . It provides an online editable text Dataiku DSS before 8.0.6 An Access Control Error vulnerability exists that stems from insufficient access control in the jupiter notebooks integration, which allows a user to read and overwrite notebooks in...
PT-2021-4088 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 13.10 and later Description: The issue is related to a stored XSS in the blob viewer of notebooks, which can be exploited by a remote attacker to impact data integrity. This is due to the lack of protection measures for the we...
CVE-2020-8354
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution...
Joplin 1.0.245 Cross Site Scripting / Code Execution
Exploit Title: Joplin 1.0.245 - Arbitrary Code Execution PoC Date: 2020-09-21 Exploit Author: Ademar Nowasky Junior @nowaskyjr Vendor Homepage: https://joplinapp.org/ Software Link: https://github.com/laurent22/joplin/releases/download/v1.0.245/Joplin-Setup-1.0.245.exe Version: 1.0.190 to 1.0.245...
GitLab: Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances
NOTE: I am still researching whether there is a possibility to deploy the exploit without user interaction. Summary GitLab provides a rich representation for Jupyter Notebooks .ipynb. In turn, Jupyter Notebooks provide the possibility for rich output via HTML. Although most tags and attributes ar...
CVE-2020-8321
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution...
CVE-2020-8321
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution...
CVE-2020-8322
A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution...
Buffer overflow
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, fixed and publicly disclosed in 2015 in the Lenovo Service Engine LSE, affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execu...
Code injection
DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name...
Unspecified Vulnerability in ASUS ATK Package
ASUS ATK Package is a software package from Asus Taiwan, China for installing drivers and software in ASUS computers. A security vulnerability exists in the AsLdrSrv.exe file in versions prior to ASUS ATK Package V1.0.0061 for Windows 10 notebook PCs. An attacker can exploit the vulnerability to...
Azure Sentinel updates: Improve your security operations with innovations from a cloud-native SIEM
Just a month ago, I communicated the details about Azure Sentinel reaching general availability. Since then, many customers have shared how Azure Sentinel has empowered their teams to be nimble and more efficient. ASOS, one of the largest online fashion retailers, is an excellent example of this...
August 6, 2019, update for OneNote 2016 (KB4092450)
None None...
HELK - The Hunting ELK
The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed...
Jupyter Notebook XSS via untrusted notebooks
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
GHSA-49QR-XH3W-H436 Jupyter Notebook XSS via untrusted notebooks
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...