auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +45 more potentially affected by CVE-2024-37058 via mlflow (>=2.5.0, <=2.14.1)

mlflow PYPI version =2.5.0, =1.0.0, =1.0.1, =0.0.26, =0.1.3, =1.2.0, =0.9.21, =0.0.10, =0.0.9, =1.0.0, =0.1.0, =0.1.1, =0.1.2, =0.1.4 and more Source cves: CVE-2024-37058 Source advisory: GHSA-CWGG-W6MP-W9HG...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +183 more potentially affected by CVE-2024-37061 via mlflow (>=1.11.0, <=2.13.1)

mlflow PYPI version =1.11.0, =0.1.0, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =0.0.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =1.2.13 and more Source cves: CVE-2024-37061 Source advisory: GHSA-PQCV-QW2R-R859...

GHSA-76CG-CFHX-373F MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

GHSA-GHV6-9R9J-WH4J vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +193 more potentially affected by CVE-2024-37053 via mlflow (>=1.2.0, <=2.14.1)

mlflow PYPI version =1.2.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37053 Source advisory: OSV:GHSA-43C4-9QGJ-X742...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +193 more potentially affected by CVE-2024-37052 via mlflow (>=1.2.0, <=2.14.1)

mlflow PYPI version =1.2.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37052 Source advisory: GHSA-76CG-CFHX-373F...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +151 more potentially affected by CVE-2024-37056 via mlflow (>=1.23.0, <=2.14.1)

mlflow PYPI version =1.23.0, =0.1.0, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.10.0 and more Source cves: CVE-2024-37056 Source advisory: OSV:GHSA-7P8J-QV6X-F4G4...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +149 more potentially affected by CVE-2024-37055 via mlflow (>=1.24.0, <=2.14.1)

mlflow PYPI version =1.24.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.14.18rc5, =0.21.4 and more Source cves: CVE-2024-37055 Source advisory: OSV:GHSA-X38X-G6GR-JQFF...

GHSA-GHV6-9R9J-WH4J MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

GHSA-7P8J-QV6X-F4G4 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-X38X-G6GR-JQFF MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-43C4-9QGJ-X742 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-76CG-CFHX-373F vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-X38X-G6GR-JQFF vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +194 more potentially affected by CVE-2024-37054 via mlflow (>=0.9.0, <=2.14.1)

mlflow PYPI version =0.9.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.23, =0.0.1, =1.0.41, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37054 Source advisory: GHSA-GHV6-9R9J-WH4J...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +193 more potentially affected by CVE-2024-37052 via mlflow (>=1.2.0, <=2.14.1)

mlflow PYPI version =1.2.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37052 Source advisory: OSV:GHSA-76CG-CFHX-373F...