CVE

Id
84215  
CVE No.
CVE-2015-6938  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.  
Phase
Assigned (20150914)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
746676 84215 CVE-2015-6938 MLIST:[oss-security] 20150902 CVE Request : CSRF in IPython/Jupyter notebook Tree.  View
746677 84215 CVE-2015-6938 URL:http://seclists.org/oss-sec/2015/q3/474  View
746678 84215 CVE-2015-6938 MLIST:[oss-security] 20150914 Re: CVE Request : CSRF in IPython/Jupyter notebook Tree.  View
746679 84215 CVE-2015-6938 URL:http://seclists.org/oss-sec/2015/q3/544  View
746680 84215 CVE-2015-6938 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1259405  View
746681 84215 CVE-2015-6938 CONFIRM:https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892  View
746682 84215 CVE-2015-6938 CONFIRM:https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed  View
746683 84215 CVE-2015-6938 CONFIRM:https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3  View
746684 84215 CVE-2015-6938 FEDORA:FEDORA-2015-14901  View
746685 84215 CVE-2015-6938 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.html  View
746686 84215 CVE-2015-6938 FEDORA:FEDORA-2015-14902  View
746687 84215 CVE-2015-6938 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.html  View
746688 84215 CVE-2015-6938 FEDORA:FEDORA-2015-16128  View
746689 84215 CVE-2015-6938 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html  View
746690 84215 CVE-2015-6938 SUSE:openSUSE-SU-2015:1699  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
10234 JVNDB-2015-005554 Apple iOS および OS X の FontParser における任意のコードを実行される脆弱性 Apple iOS および OS X の FontParser は、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。 CVE-2015-6990 84215 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005554.html  View