apk package
chainguard/kubeflow-pipelines-visualization-server
pkg:apk/chainguard/kubeflow-pipelines-visualization-server
Vulnerabilities (103)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-5206 | Med | 4.7 | < 2.3.0-r1 | 2.3.0-r1 | Jun 6, 2024 | A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data wit | |
| CVE-2024-35178 | Hig | 7.5 | < 2.4.0-r0 | 2.4.0-r0 | Jun 6, 2024 | The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access | |
| CVE-2024-5629 | Med | 4.7 | < 2.2.0-r0 | 2.2.0-r0 | Jun 5, 2024 | An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory. | |
| CVE-2024-35195 | Med | 5.6 | < 2.3.0-r0 | 2.3.0-r0 | May 20, 2024 | Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes | |
| CVE-2024-34069 | Hig | 7.5 | < 2.4.0-r0 | 2.4.0-r0 | May 6, 2024 | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain | |
| CVE-2024-34064 | Med | 5.4 | < 2.4.0-r0 | 2.4.0-r0 | May 6, 2024 | Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an ap | |
| CVE-2024-4340 | Hig | 7.5 | < 2.2.0-r0 | 2.2.0-r0 | Apr 30, 2024 | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. | |
| CVE-2023-29483 | Hig | 7.0 | < 2.2.0-r0 | 2.2.0-r0 | Apr 11, 2024 | eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred | |
| CVE-2024-28219 | Med | 6.7 | < 2.2.0-r0 | 2.2.0-r0 | Apr 3, 2024 | In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. | |
| CVE-2024-27454 | Hig | 7.5 | < 2.2.0-r0 | 2.2.0-r0 | Feb 26, 2024 | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. | |
| CVE-2023-50447 | Hig | 8.1 | < 2.4.1-r2 | 2.4.1-r2 | Jan 19, 2024 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). | |
| CVE-2024-22195 | Med | 5.4 | < 2.4.0-r0 | 2.4.0-r0 | Jan 11, 2024 | Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` f | |
| CVE-2023-49080 | Low | 3.5 | < 2.4.0-r0 | 2.4.0-r0 | Dec 4, 2023 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can includ | |
| CVE-2023-47248 | Cri | 9.8 | < 0 | 0 | Nov 9, 2023 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vul | |
| CVE-2023-46136 | Hig | 8.0 | < 2.4.0-r0 | 2.4.0-r0 | Oct 25, 2023 | Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are | |
| CVE-2023-40170 | Med | 4.6 | < 2.4.0-r0 | 2.4.0-r0 | Aug 28, 2023 | jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit | |
| CVE-2023-39968 | Med | 4.3 | < 2.4.0-r0 | 2.4.0-r0 | Aug 28, 2023 | jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter | |
| CVE-2023-25577 | Hig | 7.5 | < 2.4.0-r0 | 2.4.0-r0 | Feb 14, 2023 | Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory | |
| CVE-2023-23934 | Low | 2.6 | < 2.4.0-r0 | 2.4.0-r0 | Feb 14, 2023 | Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad | |
| CVE-2023-24816 | Med | 4.5 | < 2.17.0-r0 | 2.17.0-r0 | Feb 10, 2023 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This v |
- affected < 2.3.0-r1fixed 2.3.0-r1
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data wit
- affected < 2.4.0-r0fixed 2.4.0-r0
The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access
- affected < 2.2.0-r0fixed 2.2.0-r0
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- affected < 2.3.0-r0fixed 2.3.0-r0
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes
- affected < 2.4.0-r0fixed 2.4.0-r0
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain
- affected < 2.4.0-r0fixed 2.4.0-r0
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an ap
- affected < 2.2.0-r0fixed 2.2.0-r0
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
- affected < 2.2.0-r0fixed 2.2.0-r0
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred
- affected < 2.2.0-r0fixed 2.2.0-r0
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
- affected < 2.2.0-r0fixed 2.2.0-r0
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
- affected < 2.4.1-r2fixed 2.4.1-r2
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- affected < 2.4.0-r0fixed 2.4.0-r0
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` f
- affected < 2.4.0-r0fixed 2.4.0-r0
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can includ
- affected < 0fixed 0
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vul
- affected < 2.4.0-r0fixed 2.4.0-r0
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are
- affected < 2.4.0-r0fixed 2.4.0-r0
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit
- affected < 2.4.0-r0fixed 2.4.0-r0
jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter
- affected < 2.4.0-r0fixed 2.4.0-r0
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory
- affected < 2.4.0-r0fixed 2.4.0-r0
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad
- affected < 2.17.0-r0fixed 2.17.0-r0
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This v
Page 5 of 6