Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: YdataAI Clear all filters
TI-2024-24602 CVE-2024-37064 · GHSA-cg49-hrj4-3rpr

Deserialization of untrusted data in YdataAI ydata-profiling

Priority HIGH 69

Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00241 Published 2024-06-04 No fix listed CWE-502
TI-2024-24601 CVE-2024-37063 · GHSA-2r57-2mrh-ggjv

Cross-site scripting in YdataAI ydata-profiling

Priority HIGH 69

A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00324 Published 2024-06-04 No fix listed CWE-79
TI-2024-24600 CVE-2024-37062 · GHSA-fpvj-m2h6-6wc5

Deserialization of untrusted data in YdataAI ydata-profiling

Priority HIGH 69

Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00241 Published 2024-06-04 No fix listed CWE-502