madhujahagirdar/your-first-neural-network

your-first-neural-network's Issues

CVE-2019-6446 High Severity Vulnerability detected by WhiteSource

CVE-2019-6446 - High Severity Vulnerability

Vulnerable Library - numpy-1.12.1-cp35-cp35m-manylinux1_x86_64.whl

NumPy: array processing for numbers, strings, records, and objects.

path: /tmp/git/your-first-neural-network/requirements.txt,/your-first-neural-network/requirements.txt

Library home page: https://pypi.python.org/packages/71/5c/945047c185332bbaf57c400dc4c9bffa13c97486df3cd99e25a641f1cbbb/numpy-1.12.1-cp35-cp35m-manylinux1_x86_64.whl

Dependency Hierarchy:

• ❌ numpy-1.12.1-cp35-cp35m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.

Publish Date: 2019-01-16

URL: CVE-2019-6446

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

CVE-2017-16876 Medium Severity Vulnerability detected by WhiteSource

CVE-2017-16876 - Medium Severity Vulnerability

Vulnerable Library - mistune-0.7.4-py2.py3-none-any.whl

The fastest markdown parser in pure Python

path: /your-first-neural-network/requirements.txt,/tmp/git/your-first-neural-network/requirements.txt

Library home page: https://pypi.python.org/packages/7b/ab/e71dd1ca31addcd0268c54859eaf75414a10fbc48c79078f7c3066e6ed0d/mistune-0.7.4-py2.py3-none-any.whl

Dependency Hierarchy:

• ❌ mistune-0.7.4-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

Publish Date: 2017-12-29

URL: CVE-2017-16876

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1524596

Fix Resolution: Upgrade to version python-mistune-0.8.3-1.fc26 python-mistune-0.8.3-1.fc27 or greater

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19351 Medium Severity Vulnerability detected by WhiteSource

CVE-2018-19351 - Medium Severity Vulnerability

Vulnerable Library - notebook-4.4.1-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

path: /your-first-neural-network/requirements.txt,/tmp/git/your-first-neural-network/requirements.txt

Library home page: https://pypi.python.org/packages/27/2b/1e156aeaad6425f7f8adc4bab19a200157bb5cecb6c6ececbd0e74b52e02/notebook-4.4.1-py2.py3-none-any.whl

Dependency Hierarchy:

• jupyter-1.0.0-py2.py3-none-any.whl (Root Library)
  • ipywidgets-6.0.0-py2.py3-none-any.whl
    • widgetsnbextension-2.0.0-py2.py3-none-any.whl
      • ❌ notebook-4.4.1-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

Publish Date: 2018-11-18

URL: CVE-2018-19351

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jupyter/notebook@107a89f

Release Date: 2018-10-22

Fix Resolution: Replace or update the following file: handlers.py

---

Step up your Open Source Security Game with WhiteSource here

CVE-2017-15612 Medium Severity Vulnerability detected by WhiteSource

CVE-2017-15612 - Medium Severity Vulnerability

Vulnerable Library - mistune-0.7.4-py2.py3-none-any.whl

The fastest markdown parser in pure Python

path: /your-first-neural-network/requirements.txt,/tmp/git/your-first-neural-network/requirements.txt

Library home page: https://pypi.python.org/packages/7b/ab/e71dd1ca31addcd0268c54859eaf75414a10fbc48c79078f7c3066e6ed0d/mistune-0.7.4-py2.py3-none-any.whl

Dependency Hierarchy:

• ❌ mistune-0.7.4-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.

Publish Date: 2017-10-19

URL: CVE-2017-15612

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: lepture/mistune@d6f0b64

Release Date: 2017-10-18

Fix Resolution: Replace or update the following files: mistune.py, __init__.py, test_extra.py

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19352 Medium Severity Vulnerability detected by WhiteSource

CVE-2018-19352 - Medium Severity Vulnerability

Vulnerable Library - notebook-4.4.1-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

path: /your-first-neural-network/requirements.txt,/tmp/git/your-first-neural-network/requirements.txt

Library home page: https://pypi.python.org/packages/27/2b/1e156aeaad6425f7f8adc4bab19a200157bb5cecb6c6ececbd0e74b52e02/notebook-4.4.1-py2.py3-none-any.whl

Dependency Hierarchy:

• jupyter-1.0.0-py2.py3-none-any.whl (Root Library)
  • ipywidgets-6.0.0-py2.py3-none-any.whl
    • widgetsnbextension-2.0.0-py2.py3-none-any.whl
      • ❌ notebook-4.4.1-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.

Publish Date: 2018-11-18

URL: CVE-2018-19352

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jupyter/notebook@288b73e

Release Date: 2018-11-18

Fix Resolution: Replace or update the following file: notebooklist.js

---

Step up your Open Source Security Game with WhiteSource here