Ipython vulnerabilities

CVE-2023-24816 [HIGH] CWE-20 CVE-2023-24816: IPython (Interactive Python) is a command shell for interactive computing in multiple programming la IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_t

CVE-2015-7337 [CRITICAL] CWE-20 Improper Input Validation in Jupyter Notebook Improper Input Validation in Jupyter Notebook The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.

CVE-2014-3429 [HIGH] CWE-94 IPython Notebook vulnerable to improper validation of the origin of websocket requests IPython Notebook vulnerable to improper validation of the origin of websocket requests IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

CVE-2015-6938 [MEDIUM] CWE-79 Improper Neutralization of Input During Web Page Generation in Jupyter Notebook Improper Neutralization of Input During Web Page Generation in Jupyter Notebook Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery

CVE-2022-21699 [HIGH] CWE-250 CVE-2022-21699: IPython (Interactive Python) is a command shell for interactive computing in multiple programming la IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as

CVE-2018-8768 [HIGH] CVE-2018-8768: In Jupyter Notebook before 5 In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

CVE-2015-4706 [MEDIUM] CWE-79 CVE-2015-4706: Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.

CVE-2015-5607 [HIGH] CWE-352 CVE-2015-5607: Cross-site request forgery in the REST API in IPython 2 and 3. Cross-site request forgery in the REST API in IPython 2 and 3.

CVE-2015-4707 [MEDIUM] CWE-79 CVE-2015-4707: Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arb Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.