CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10255
https://notcve.org/view.php?id=CVE-2019-10255
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected. Una vulnerabilidad de redirección abierta para todos los navegadores en Jupyter Notebook, en versiones anteriores a la 5.7.7, y en algunos navegadores (Chrome, Firefox) en JupyterHub, en versiones anteriores a la 0.9.5, permite que los enlaces manipulados accedan a la página de inicio de sesión, lo que redirigirá a un sitio malicioso después de un inicio de sesión exitoso. No se ven afectados los servidores que ejecutan un prefijo "base_url". • https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4 https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D https://lists.fedoraproject.org/archive • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9644
https://notcve.org/view.php?id=CVE-2019-9644
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered. Una vulnerabilidad de Cross-Site Inclusion (XSSI) en Jupyter Notebook, en versiones anteriores a la 5.7.6, permite la inclusión de recursos en páginas maliciosas cuando recibe visitas de usuarios autenticados con un servidor Jupyter. Se ha demostrado el acceso al contenido de los recursos con Internet Explorer mediante la captura de avisos de error, aunque no se ha reproducido en otros navegadores. • https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-19352
https://notcve.org/view.php?id=CVE-2018-19352
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely. Jupyter Notebook en versiones anteriores a la 5.7.2 permite Cross-Site Scripting (XSS) mediante un nombre de directorio manipulado debido a que notebook/static/tree/js/notebooklist.js gestiona ciertas URL de forma no segura. • https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648 https://pypi.org/project/notebook/#history • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-19351
https://notcve.org/view.php?id=CVE-2018-19351
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this. Jupyter Notebook en versiones anteriores a la 5.7.1 permite Cross-Site Scripting (XSS) mediante un notebook no fiable debido a que se considera que las respuestas nbconvert tienen el mismo origen que el servidor notebook. En otras palabras, los endpoints nbconvert pueden ejecutar JavaScript con acceso a la API del servidor. • https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491 https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html https://pypi.org/project/notebook/#history • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8768
https://notcve.org/view.php?id=CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous. En Jupyter Notebook, en versiones anteriores a la 5.4.1, un archivo notebook maliciosamente manipulado puede omitir el saneamiento para ejecutar JavaScript en el contexto del notebook. Específicamente, el HTML no válido es "arreglado" por jQuery tras el saneamiento, haciéndolo peligroso. • http://openwall.com/lists/oss-security/2018/03/15/2 https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html •