CVE-2015-4706
published 2017-09-21CVE-2015-4706: Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON…
PriorityP423medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.63%
73.5th percentile
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ipython | — | — |
| ipython | ipython | < 7222bd53ad089a65fd610fab4626f9d0ab47dfce | 7222bd53ad089a65fd610fab4626f9d0ab47dfce |
| ipython | ipython | — | — |
| ipython | ipython | — | — |
| ipython | ipython | >= 0 < c2078a53543ed502efd968649fee1125e0eb549c | c2078a53543ed502efd968649fee1125e0eb549c |
| ipython | ipython | >= 3.0.0 < 3.2.0 | 3.2.0 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_debian6.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Neutralization of Input During Web Page Generation in IPython
osv·2022-05-17
CVE-2015-4706 [MEDIUM] Improper Neutralization of Input During Web Page Generation in IPython
Improper Neutralization of Input During Web Page Generation in IPython
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
GHSA
Improper Neutralization of Input During Web Page Generation in IPython
ghsa·2022-05-17
CVE-2015-4706 [MEDIUM] CWE-79 Improper Neutralization of Input During Web Page Generation in IPython
Improper Neutralization of Input During Web Page Generation in IPython
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
OSV
CVE-2015-4706: Cross-site scripting (XSS) vulnerability in IPython 3
osv·2017-09-21
CVE-2015-4706 CVE-2015-4706: Cross-site scripting (XSS) vulnerability in IPython 3
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Debian
CVE-2015-4706: ipython - Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote...
vendor_debian·2015·CVSS 6.1
CVE-2015-4706 [MEDIUM] CVE-2015-4706: ipython - Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote...
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2015/06/22/7http://www.securityfocus.com/bid/75328https://bugzilla.redhat.com/show_bug.cgi?id=1235688https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfcehttps://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549chttps://ipython.org/ipython-doc/3/whatsnew/version3.htmlhttp://www.openwall.com/lists/oss-security/2015/06/22/7http://www.securityfocus.com/bid/75328https://bugzilla.redhat.com/show_bug.cgi?id=1235688https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfcehttps://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549chttps://ipython.org/ipython-doc/3/whatsnew/version3.html
2017-09-21
Published