CVE-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields...

CVE-2024-27132 Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables...

GHSA-QG8P-32GR-GH6X MLflow Local File Disclosure Vulnerability

This vulnerability enables malicious users to read sensitive files on the server...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow. An attacker exploited the vulnerability to execute commands and access data and model information on a vulnerable computer...

Mlflow Code Issue Vulnerability

Mlflow is an open source platform for machine learning lifecycle. Mlflow suffers from a code issue vulnerability. An attacker exploiting this vulnerability could remotely execute code on a victim computer...

GHSA-554W-XH4J-8W64 Path traversal in MLflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

GHSA-V945-R3RC-6FJM Path traversal in MLflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

MLFlow Security Vulnerability

Mlflow is an open source platform for the machine learning lifecycle. A security vulnerability exists in MLFlow version 2.8.1 and prior versions. A remote attacker exploited the vulnerability to obtain sensitive information via a specially crafted REST API request...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

GHSA-5P3H-7FWH-92RC Remote Code Execution due to Full Controled File Write in mlflow

The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycle. Mlflow has a security vulnerability that stems from allowing an unauthorized attacker to overwrite any file on MLflow's servers...

PT-2023-32481

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows an attacker to overwrite any file on the server hosting MLflow without authentication. This gives multiple ways to achieve code execution, such as overwriting /home//.bashrc. ...

PT-2023-32477

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows an attacker to arbitrarily create an account in MLflow, bypassing any authentication requirement. Recommendations At the moment, there is no information about a newer version...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.3.1. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...