Jupyter Jupyterhub

XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

incomplete logout in JupyterHub

JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

JupyterHub has an Open Redirect Vulnerability

JupyterHub: Cross-origin form POSTs bypass XSRF

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).