mlflow-asus-aimaker (>=0.0.6, <=1.0.2), newsmodel (0.1.0) +3 more potentially affected by CVE-2023-2780 via mlflow (1.24.0)

mlflow PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-asus-aimaker =0.0.6, =1.3.0, =3.1.1, =3.1.4, =3.1.6 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2023-2780 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2023-2780 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2023-2780 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2023-2780 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

azureml-evaluate-mlflow (>=0.0.1, <=0.0.2), ride-duration-prediction-sunxi1010 (0.3.0) +1 more potentially affected by CVE-2023-2780 via mlflow (1.28.0)

mlflow PYPI version 1.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.1, =0.0.1, =0.3.4 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2023-2780 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2023-2780 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

cnext (>=0.3.5, <=0.3.8), code-first-pipelines (>=0.8.0, <=1.0.0) +51 more potentially affected by CVE-2023-2780 via mlflow (1.30.1)

mlflow PYPI version 1.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - cnext =0.3.5, =0.8.0, =0.6.1rc1, =0.2.4, =0.24.24, =0.0.1a0, =1.0.1, =0.1.1, =0.3.0, =0.8.3, =0.48.0, =0.2.0, =0.2.0, =0.3.0 and more Source cves:...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.12) +17 more potentially affected by CVE-2023-2780 via mlflow (>=2.0.0rc0, <=2.3.0)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.8.0, =0.0.1, =1.10.2, =0.2.0rc0, =1.6.1, =0.2.0, =0.1.0, =1.0.0rc5, =0.1.0, =0.1.7 and more Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

PYSEC-2023-69

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by CVE-2023-2780 via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

CVE-2023-2780 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2780

CVE-2023-2780 affects the open-source project mlflow/mlflow prior to version 2.3.1. A path traversal flaw, described as a Local File Inclusion bypass via the payload "..\filename", can allow an attacker to read local files on the server. The Nuclei/NVD entries consistently reference this vulnerab...

CVE-2023-2780 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2780 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2780: Path Traversal: '\..\filename'

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +149 more potentially affected by CVE-2023-2780 via mlflow (>=0.8.2, <=2.2.2)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.3.5, =0.8.0, =0.8.0, =0.14.18rc5, =0.6.1rc1, =0.6.1 and more Source cves: CVE-2023-2780 Source advisory: MEND:CVE-2023-2780...

PT-2023-21350 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.3.1 Description: The issue is related to path traversal, where the sequence '..filename' can be used to bypass security restrictions. This allows unauthorized access to files and directories outside the intended...

Mlflow security vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.3.1 that stems from being able to read local files...