dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2024-1558 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

deepinterpolation (>=0.1.3, <=0.1.4), scanflow (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2024-1558 via mlflow (1.14.1)

mlflow PYPI version 1.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepinterpolation =0.1.3, =0.1.0, =0.0.1, =0.7.1 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2024-1558 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2024-1593 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2024-1594 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1593 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-1593 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2024-1560 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2024-1560 Source advisory: OSV:GHSA-5MVJ-WMGJ-7Q8C...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the deleteartifactmlflowartifacts handler and localfileuritopath function, allowing for...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthorized access to files or directories. Th...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +49 more potentially affected by CVE-2024-1558 via mlflow (>=2.0.0rc0, <=2.9.2)

mlflow PYPI version =2.0.0rc0, =1.0.0, =1.0.1, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.8.2 and more Source cves: CVE-2024-1558 Source advisory: GHSA-J62R-WXQQ-F3GF...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1560 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1560 Source advisory: OSV:GHSA-5MVJ-WMGJ-7Q8C...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1558 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-1593 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2024-1558 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-1594 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2024-1594 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2024-1560 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2024-1560 Source advisory: OSV:GHSA-5MVJ-WMGJ-7Q8C...