GHSA-CXFR-5Q3R-2RC2 Jinja2 template injection in mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PT-2023-32757 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to Path Traversal in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 or later to resolve the issue...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.9.2 that stems from incorrect neutralization of special elements used in the template engine...

PT-2023-32744 · Jinja2 +1 · Jinja2 +1

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to improper neutralization of special elements used in a template engine. This can lead to remote code execution due to jinja2 SSTI in MLflow. Recommendations: For versio...

PT-2023-28147 · Sustainsys +1 · Sustainsys.Saml2 +1

Name of the Vulnerable Software and Affected Versions: Sustainsys.Saml2 versions prior to 1.0.3 Sustainsys.Saml2 versions prior to 2.9.2 Description: The Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. When a response is...

CVE-2023-39534

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this iss...

PT-2023-4901 · Eprosima +2 · Eprosima Fast Dds +2

Name of the Vulnerable Software and Affected Versions: eprosima Fast DDS versions prior to 2.10.0 eprosima Fast DDS versions prior to 2.9.2 eprosima Fast DDS versions prior to 2.6.5 Description: The issue is related to the use of the assert function or a similar operator in the eprosima Fast DDS...

PT-2023-6139 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP versions 2.8.0 through 2.9.2 Description: The issue is related to a command injection vulnerability. It allows an authenticated attacker to execute arbitrary OS commands as root via the entity POST parameters in the /ajax/networking/ge...

Malicious code in keras-beautifulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f4e383a9ff1753757d075b6ab28633f99e4e24fbe7b01db5360243f163ea2ac The OpenSSF Package Analysis project identified 'keras-beautifulsoup' @ 2.9.2 pypi as malicious. It is considered malicious because: - The packa...

CVE-2022-45825

Unauth. Reflected Cross-Site Scripting XSS vulnerability in iThemes WPComplete plugin = 2.9.2 versions...

SUSE CVE-2007-0203

Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors...

SUSE CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service CPU consumption via a crafted XML document containing a large number of nested entity references, a...

CVE-2022-33683

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

OCS Inventory NG < 2.9.2 XSS Vulnerability

OCS Inventory NG is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Advisory ROSA-SA-2021-1837

Software: fuse 2.9.2 OS: Cobalt 7.9 CVE-ID: CVE-2015-3202 CVE-Crit: HIGH CVE-DESC: fusermount in FUSE before 2.9.3-15 incorrectly clears the environment before calling 1 mount or 2 umount as root user, which allows local users to write arbitrary files via a created environment variable...

OS Command Injection and Improper Input Validation in ansible

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...

ALPINE-CVE-2019-14904

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...