CVE-2024-35178

The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.

• CWE-200

• https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2dfPatch
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62Vendor Advisory
• https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2dfPatch
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62Vendor Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35172Server-Side Request Forgery (SSRF) vulnerability in ShortPix…4.4
• CVE-2024-35173Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-35174Missing Authorization vulnerability in Flothemes Flo Forms.T…5.3
• CVE-2024-35175sshpiper is a reverse proxy for sshd. Starting in version 1.…5.3
• CVE-2024-35176 REXML is an XML toolkit for Ruby. The REXML gem before 3.2.…5.3
• CVE-2024-35177Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2024-35179Stalwart Mail Server is an open-source mail server. Prior to…6.8
• CVE-2024-3518The Media Library Assistant plugin for WordPress is vulnerab…6.5
• CVE-2024-35180OMERO.web provides a web based client and plugin infrastruct…6.1
• CVE-2024-35181Meshery is an open source, cloud native manager that enables…8.1
• CVE-2024-35182Meshery is an open source, cloud native manager that enables…8.1
• CVE-2024-35183wolfictl is a command line tool for working with Wolfi. A gi…4.4