CVE-2024-41118

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 47 of pages/7📦WebMapService.py takes user input, which is passed to getlayers function, in which url is used with getwmslayer method...

CVE-2024-41114

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 430 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 435, leading to remote code executio...

CVE-2024-41115

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 488 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 493, leading to remote code executio...

CVE-2024-41119

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 80 in 8🏜️RasterDataVisualization.py takes user input, which is later used in the eval function on line 86, leading to remote code...

CVE-2024-41120

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

NTLM Credential Theft Risk in Python Apps Threaten Windows Security

New research reveals critical vulnerabilities in Python applications for Windows including Snowflake, Gradio, Jupyter, and Streamlit that could…...

Path Traversal

Streamlit is vulnerable to a Path Traversal. The vulnerability is due to improper handling of file paths in the static file sharing feature of Streamlit on Windows systems, which allows an attacker to traverse directories and access the password hash of the Windows user running Streamlit...

punditkit (0.0.1) potentially affected by CVE-2024-42474 via streamlit (0.52.2)

streamlit PYPI version 0.52.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - punditkit 0.0.1 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

alphapept (0.3.29), classy-core (>=0.1.0.dev20211019, <=0.2.0) +3 more potentially affected by CVE-2024-42474 via streamlit (0.88.0)

streamlit PYPI version 0.88.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - alphapept 0.3.29 - classy-core =0.1.0.dev20211019, =0.0.143, =0.4.0, =0.0.3, =0.0.4 Source cves: CVE-2024-42474 Source advisory:...

raylab (0.14.11) potentially affected by CVE-2024-42474 via streamlit (0.68.1)

streamlit PYPI version 0.68.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - raylab 0.14.11 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

streamlit-gallery (0.1.0), streamlit-image-crop (>=0.1.0, <=0.2.0) potentially affected by CVE-2024-42474 via streamlit (0.76.0)

streamlit PYPI version 0.76.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - streamlit-gallery 0.1.0 - streamlit-image-crop =0.1.0, =0.2.0 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

liveisstracker (>=0.0.2, <=1.0.12), raylab (>=0.15.1, <=0.15.4) potentially affected by CVE-2024-42474 via streamlit (0.78.0)

streamlit PYPI version 0.78.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - liveisstracker =0.0.2, =0.15.1, =0.15.4 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

advanced-data-generator (1.0.0), agentbruno (>=0.0.2, <=0.0.5) +171 more potentially affected by CVE-2024-42474 via streamlit (>=1.0.0, <=1.36.0)

streamlit PYPI version =1.0.0, =0.0.2, =1.0.4, =0.8.0, =0.4.1, =1.6.1, =0.2.0, =0.0.7, =0.1.0, =0.1.0, =0.1.72 and more Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

maupassant (0.1.1) potentially affected by CVE-2024-42474 via streamlit (0.65.0)

streamlit PYPI version 0.65.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - maupassant 0.1.1 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

carbonify (>=0.1.0, <=0.1.1), unity-cv-datasetvisualizer (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-42474 via streamlit (0.84.1)

streamlit PYPI version 0.84.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - carbonify =0.1.0, =0.0.1, =0.1.2 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

streamlit-aggrid (0.2.2), streamlit-inspect (0.1.0) potentially affected by CVE-2024-42474 via streamlit (0.89.0)

streamlit PYPI version 0.89.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - streamlit-aggrid 0.2.2 - streamlit-inspect 0.1.0 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

madan (0.1.0), sapsan (>=0.4.4, <=0.5.0) +1 more potentially affected by CVE-2024-42474 via streamlit (0.84.2)

streamlit PYPI version 0.84.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - madan 0.1.0 - sapsan =0.4.4, =0.5.0 - streamlit-pages 0.1.0 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

hlm-texts (0.1.2), suzieq (>=0.8.0, <=0.10.0) potentially affected by CVE-2024-42474 via streamlit (0.72.0)

streamlit PYPI version 0.72.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - hlm-texts 0.1.2 - suzieq =0.8.0, =0.10.0 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

bqtxflowutils-2 (>=0.0.4, <=0.0.6), example-pkg-again (>=0.0.1, <=0.0.3) +4 more potentially affected by CVE-2024-42474 via streamlit (0.83.0)

streamlit PYPI version 0.83.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - bqtxflowutils-2 =0.0.4, =0.0.1, =0.0.1, =0.0.5, =0.0.8 - sundial-framework 0.1.0 Source cves: CVE-2024-42474 Source advisory:...

bubbletea-py (0.0.2), streamlit-kpi-metric (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-42474 via streamlit (0.86.0)

streamlit PYPI version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - bubbletea-py 0.0.2 - streamlit-kpi-metric =0.1.0, =0.1.1 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...