CVE-2024-37052

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-5463

A vulnerability regarding buffer copy without checking the size of input 'Classic Buffer Overflow' has been found in the login component. This allows remote attackers to write specific files containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors...

Improper Permission Check

Wagtail is vulnerable to Improper Permission Check. The vulnerability is due to an improperly applied permission check in the wagtail.contrib.settings module, allowing users with admin access to modify settings models without proper permissions...

PT-2024-27272

Name of the Vulnerable Software and Affected Versions MLflow platform versions 2.0.0rc0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user's system when interacted with. Recommendations Fo...

PT-2024-27271

Name of the Vulnerable Software and Affected Versions MLflow versions 1.23.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations Fo...

PT-2024-27270

Name of the Vulnerable Software and Affected Versions MLflow versions 1.24.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user's system when interacted with. Recommendations For versions...

PT-2024-27267

Name of the Vulnerable Software and Affected Versions MLflow versions 1.1.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflow...

Ollama Reverse DNS Rebinding

The vulnerability of Ollama’s system for running and managing large language models is related to the use of reverse DNS resolution for IP addresses. Exploiting this vulnerability could allow a remote attacker to perform a DNS Rebinding attack or cause a service failure...

MAI-2024-0055

Large Vision Language Models LVLMs are susceptible to a sophisticated attack known as the bi-modal adversarial prompt BAP. This attack exploits the integration of textual and visual prompts to circumvent established safety protocols, thereby eliciting harmful outputs from models engineered to...

Moodle CSRF risk in analytics management of models

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

GHSA-68X5-4JG5-GJGG Moodle CSRF risk in analytics management of models

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

CVE-2024-34008

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

UBUNTU-CVE-2024-34008

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

CVE-2024-34008

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

CVE-2024-34008 moodle: CSRF risk in analytics management of models

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

CVE-2024-34008

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

GitLab: IDOR Exposes All Machine Learning Models

The vulnerability allows an attacker to access any Machine Learning Model Registry in GitLab, including private models, by guessing the incremental model IDs. The attacker can also access different versions of the models. This vulnerability was present in GitLab versions 15.11 and 16.2...

CVE-2024-34008: Cross-Site Request Forgery (CSRF)

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

PT-2024-25636 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue concerns a CSRF risk in the admin management of analytics models due to the lack of a necessary token. This could allow unauthorized actions on behalf of users. Recommendations: At...

[SECURITY] Fedora 40 Update: qt6-qtscxml-6.7.1-1.fc40

The Qt SCXML module provides functionality to create state machines from SCXM L files. This includes both dynamically creating state machines loading the SCXML file and instantiating states and transitions and generating a C++ file that has a class implementing the state machine. It also contains...