| CVE-2025-52967 |
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation
|
5.8
Moyenne
|
23 juin 2025 |
| CVE-2024-27134 |
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
|
7.0
Élevée
|
25 nov. 2024 |
| CVE-2024-2928 |
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was…
|
7.5
Élevée
|
6 juin 2024 |
| CVE-2024-3099 |
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by…
|
5.4
Moyenne
|
6 juin 2024 |
| CVE-2024-37061 |
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37060 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37058 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer,…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37057 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer,…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37056 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37055 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37054 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer,…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37053 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer,…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-37052 |
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer,…
|
8.8
Élevée
|
4 juin 2024 |
| CVE-2024-3848 |
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously…
|
7.5
Élevée
|
16 mai 2024 |
| CVE-2024-3573 |
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to…
|
9.3
Critique
|
16 avr. 2024 |
| CVE-2024-1594 |
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the…
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-1558 |
A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the…
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-27133 |
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset
|
7.5
Élevée
|
23 févr. 2024 |
| CVE-2024-27132 |
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe
|
7.5
Élevée
|
23 févr. 2024 |
| CVE-2023-3765 |
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0
|
10.0
Critique
|
19 juil. 2023 |