pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update pyyaml from 6.0 to 6.0.1
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update alembic from 1.7.7 to 1.13.0
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update wheel from 0.38.2 to 0.42.0
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update black from 22.3.0 to 23.11.0
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update mkdocstrings from 0.18.1 to 0.24.0
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update mkdocs-material from 8.2.12 to 9.4.14
scipy 1.8.0 and scikit-learn 1.0.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update pymdown-extensions from 10.0.1 to 10.5
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
pyup-scheduled-update-2023-12-01
1 year, 8 months ago
Update mkdocs from 1.3.0 to 1.5.3
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
postmodeling_revision_2023
1 year, 8 months ago
Merge branch 'dev' into postmodeling_revision_2023
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
dev
1 year, 9 months ago
Update __init__.py
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
postmodeling_revision_2023
1 year, 9 months ago
bring dev in
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
dev
1 year, 9 months ago
missing space
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
dev
1 year, 9 months ago
generating gzip with command line
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
dev
1 year, 9 months ago
data frame columns
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
dev
1 year, 9 months ago
label as series from polars while stitching
scipy 1.8.0, scikit-learn 1.0.2 and mkdocs-material 8.2.12 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| scikit-learn | 1.0.2 | <1.5.0 |
show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer. |
| scikit-learn | 1.0.2 | <1.1.0rc1 |
show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. |
| mkdocs-material | 8.2.12 | <9.5.5 |
show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b |
| mkdocs-material | 8.2.12 | <9.1.13 |
show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521 |
| mkdocs-material | 8.2.12 | <9.5.32 |
show MKDocs Material addresses an RXSS vulnerability found in deep links within search results. |
Python 3 badge
URL
https://pyup.io/repos/github/dssg/triage/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/dssg/triage/)
Restructured Text
.. image:: https://pyup.io/repos/github/dssg/triage/python-3-shield.svg
:target: https://pyup.io/repos/github/dssg/triage/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/dssg/triage/"><img src="https://pyup.io/repos/github/dssg/triage/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/dssg/triage/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/dssg/triage/
RDoc
{<img src="https://pyup.io/repos/github/dssg/triage/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/dssg/triage/]
pyup.io badge
URL
https://pyup.io/repos/github/dssg/triage/shield.svg
Markdown
[](https://pyup.io/repos/github/dssg/triage/)
Restructured Text
.. image:: https://pyup.io/repos/github/dssg/triage/shield.svg
:target: https://pyup.io/repos/github/dssg/triage/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/dssg/triage/"><img src="https://pyup.io/repos/github/dssg/triage/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/dssg/triage/shield.svg(Updates)!:https://pyup.io/repos/github/dssg/triage/
RDoc
{<img src="https://pyup.io/repos/github/dssg/triage/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/dssg/triage/]