CVE-2024-41112

CVE-2024-41112 affects streamlit-geospatial. The palette variable in pages/1_📷_Timelapse.py accepts user input and is used in eval() at line 380, enabling remote code execution prior to commit c4f81d9616d40c60584e36abb15300853a66e489. The commit fixes this issue. NVD lists CVSS v3.1 base score 9....

CVE-2024-41118

The CVE-2024-41118 entry concerns the open-source project streamlit-geospatial, where prior to commit c4f81d9616d40c60584e36abb15300853a66e489 the url variable in pages/7_📦_Web_Map_Service.py accepts user input and passes it into get_layers, which uses get_wms_layer to send requests to arbitrary ...

CVE-2024-41117

CVE-2024-41117 affects the streamlit-geospatial project. The vulnerability arises from the vis_params variable in pages/10_🌍_Earth_Engine_Datasets.py, where user input is fed into eval(), enabling remote code execution. The issue is fixed in commit c4f81d9616d40c60584e36abb15300853a66e489. Affect...

CVE-2024-41120

Affected software: streamlit-geospatial (a Streamlit multipage geospatial app). Technical issue: the url variable in pages/9_🔲_Vector_Data_Visualization.py accepts user input and passes it to gpd.read_file, which can trigger requests to arbitrary destinations. Impact described as blind server-sid...

CVE-2024-41116

CVE-2024-41116 affects streamlit-geospatial. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable in pages/1_📷_Timelapse.py accepts user input and is subsequently used in eval(), enabling remote code execution. The commit cited fixes this issue. Several records (NVD, ...

CVE-2024-41119

The CVE-2024-41119 entry concerns streamlit-geospatial. Affected component: the page 8_🏜️_Raster_Data_Visualization.py where the vis_params parameter accepts user input that is later used in eval(), enabling remote code execution prior to the fix (commit c4f81d9616d40c60584e36abb15300853a66e489). ...

CVE-2024-41114

The CVE-2024-41114 issue affects streamlit-geospatial, specifically in pages/1_📷_Timelapse.py where the palette input is used in eval(), enabling remote code execution prior to the fix in commit c4f81d9616d40c60584e36abb15300853a66e489. The vulnerability occurs in versions prior to that commit. T...

CVE-2024-41113

CVE-2024-41113 affects streamlit-geospatial: a flaw in pages/1_📷_Timelapse.py where the vis_params user input is fed to eval(), enabling remote code execution. Root cause: unsanitized user input used in eval on lines 383–395. Impact: remote code execution with high confidentiality, integrity, and...

CVE-2024-41115

The CVE-2024-41115 entry concerns the streamlit-geospatial project, specifically the Timelapse page. Before commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 488 in pages/1_📷_Timelapse.py accepts user input and is later used in an eval() on line 493, enabling remote co...