1530 matches found
CVE-2023-6709: Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...
Mlflow Security Vulnerabilities
Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.9.2 that stems from incorrect neutralization of special elements used in the template engine...
PT-2023-32744 · Jinja2 +1 · Jinja2 +1
Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to improper neutralization of special elements used in a template engine. This can lead to remote code execution due to jinja2 SSTI in MLflow. Recommendations: For versio...
Cross Site Scripting (XSS)
mlflow is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of proper sanitization and escaping of user inputs in the Content-Type header of POST requests. An attacker can exploit this vulnerability to injecting malicious code into the header, which will then be...
Cross-site Scripting (XSS) in MLflow
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
GHSA-VWHF-3V6X-WFF8 Cross-site Scripting (XSS) in MLflow
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
CVE-2023-6568
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
Cross site scripting
Cross-site Scripting XSS - Reflected in GitHub repository mlflow/mlflow prior to 2.9.0...
PYSEC-2023-260
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
CVE-2023-6568 Reflected XSS via Content-Type Header in mlflow/mlflow
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
CVE-2023-6568
MLflow XSS (CVE-2023-6568) : A reflected XSS exists in mlflow/mlflow due to how the Content-Type header from POST requests is handled. The vulnerability is in mlflow/server/auth/init .py, where user-supplied Content-Type is directly inserted into a Python-formatted string and returned, allowing a...
CVE-2023-6568 Reflected XSS via Content-Type Header in mlflow/mlflow
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
Mlflow Cross-Site Scripting Vulnerability
Mlflow is an open source platform for machine learning lifecycle. A cross-site scripting vulnerability exists in Mlflow versions prior to 2.9.0. An attacker exploiting this vulnerability could execute a cross-site scripting attack...
CVE-2023-6568: Improper Neutralization of Input During Web Page Generation
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...
PT-2023-32696 · Mlflow · Mlflow
Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.9.0 Description: A reflected Cross-Site Scripting XSS issue exists in the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is...
Information exposure in MLflow
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...
GHSA-WQXF-447M-6F5F Information exposure in MLflow
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...
CVE-2023-43472
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...