a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +149 more potentially affected by CVE-2024-37055 via mlflow (>=1.24.0, <=2.14.1)

mlflow PYPI version =1.24.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.14.18rc5, =0.21.4 and more Source cves: CVE-2024-37055 Source advisory: GHSA-X38X-G6GR-JQFF...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +193 more potentially affected by CVE-2024-37052 via mlflow (>=1.2.0, <=2.14.1)

mlflow PYPI version =1.2.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37052 Source advisory: OSV:GHSA-76CG-CFHX-373F...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-7P8J-QV6X-F4G4 vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +194 more potentially affected by CVE-2024-37054 via mlflow (>=0.9.0, <=2.14.1)

mlflow PYPI version =0.9.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.23, =0.0.1, =1.0.41, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37054 Source advisory: OSV:GHSA-GHV6-9R9J-WH4J...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +193 more potentially affected by CVE-2024-37053 via mlflow (>=1.2.0, <=2.14.1)

mlflow PYPI version =1.2.0, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.1.3 and more Source cves: CVE-2024-37053 Source advisory: GHSA-43C4-9QGJ-X742...

CVE-2024-37061 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37061

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run...

CVE-2024-37059

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37060

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

CVE-2024-37059 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37061 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37061

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run...

CVE-2024-37059

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37060 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37060

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...