| CVE-2024-0520 |
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of…
|
10.0
Critique
|
6 juin 2024 |
| CVE-2024-3099 |
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by…
|
5.4
Moyenne
|
6 juin 2024 |
| CVE-2024-4263 |
A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with…
|
5.4
Moyenne
|
16 mai 2024 |
| CVE-2024-3848 |
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously…
|
7.5
Élevée
|
16 mai 2024 |
| CVE-2024-1483 |
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on…
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-3573 |
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to…
|
9.3
Critique
|
16 avr. 2024 |
| CVE-2024-1594 |
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the…
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-1593 |
A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-1558 |
A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the…
|
7.5
Élevée
|
16 avr. 2024 |
| CVE-2024-1560 |
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion…
|
8.1
Élevée
|
16 avr. 2024 |
| CVE-2023-6977 |
This vulnerability enables malicious users to read sensitive files on the server
|
10.0
Critique
|
20 déc. 2023 |
| CVE-2023-6976 |
This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the…
|
8.8
Élevée
|
20 déc. 2023 |
| CVE-2023-6975 |
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models…
|
9.8
Critique
|
20 déc. 2023 |
| CVE-2023-6974 |
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it…
|
8.6
Élevée
|
20 déc. 2023 |
| CVE-2023-6940 |
with only one user interaction(download a malicious config), attackers can gain full command execution on the victim…
|
9.0
Critique
|
19 déc. 2023 |
| CVE-2023-6909 |
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2
|
7.5
Élevée
|
18 déc. 2023 |
| CVE-2023-6831 |
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2
|
8.1
Élevée
|
15 déc. 2023 |
| CVE-2023-6753 |
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2
|
9.6
Critique
|
13 déc. 2023 |
| CVE-2023-6709 |
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2
|
10.0
Critique
|
12 déc. 2023 |
| CVE-2023-6568 |
A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the…
|
6.5
Moyenne
|
7 déc. 2023 |
| CVE-2023-6014 |
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment
|
9.1
Critique
|
16 nov. 2023 |
| CVE-2023-6015 |
MLflow allowed arbitrary files to be PUT onto the server
|
10.0
Critique
|
16 nov. 2023 |
| CVE-2023-6018 |
An attacker can overwrite any file on the server hosting MLflow without any authentication
|
10.0
Critique
|
16 nov. 2023 |
| CVE-2023-4033 |
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0
|
8.8
Élevée
|
1 août 2023 |
| CVE-2023-3765 |
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0
|
10.0
Critique
|
19 juil. 2023 |