Executive brief
Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
Affected products
- PyPI ipython
Junglewise Threat Intelligence
CVE-2015-4707: PYSEC-2017-46 - Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors in
CVE-2015-4707 · Severity: low · CVSS 3.1 · Published 2017-09-20
Technologies: ipython (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2023-17 - IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Py
- PYSEC-2022-12 - IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Py
- PYSEC-2017-45 - Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vector
- PYSEC-2017-47 - Cross-site request forgery in the REST API in IPython 2 and 3.
- PYSEC-2015-27 - The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript