apk package
wolfi/kubeflow-pipelines-visualization-server
pkg:apk/wolfi/kubeflow-pipelines-visualization-server
Vulnerabilities (105)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-23934 | Low | 2.6 | < 2.4.0-r0 | 2.4.0-r0 | Feb 14, 2023 | Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad | |
| CVE-2023-24816 | Med | 4.5 | < 2.17.0-r0 | 2.17.0-r0 | Feb 10, 2023 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This v | |
| CVE-2021-32862 | Hig | 7.5 | < 2.4.0-r0 | 2.4.0-r0 | Aug 18, 2022 | The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vul | |
| CVE-2022-29241 | Hig | 7.1 | < 2.4.0-r0 | 2.4.0-r0 | Jun 14, 2022 | Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the | |
| CVE-2022-21699 | Hig | 8.2 | < 2.4.0-r0 | 2.4.0-r0 | Jan 19, 2022 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cros |
- affected < 2.4.0-r0fixed 2.4.0-r0
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad
- affected < 2.17.0-r0fixed 2.17.0-r0
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This v
- affected < 2.4.0-r0fixed 2.4.0-r0
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vul
- affected < 2.4.0-r0fixed 2.4.0-r0
Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the
- affected < 2.4.0-r0fixed 2.4.0-r0
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cros
Page 6 of 6