a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +158 more potentially affected by CVE-2024-3099 via mlflow (>=0.8.2 <=2.11.1)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-3099 Source advisory: OSV:GHSA-8F8Q-Q2J7-7J2M...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +338 more potentially affected by CVE-2024-0520 via mlflow (>=0.8.2 <=2.8.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2024-0520 Source advisory: OSV:GHSA-5Q6C-FFVG-XCM9...

CVE-2024-3099

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +158 more potentially affected by CVE-2024-2928 via mlflow (>=0.8.2 <=2.11.1)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-2928 Source advisory: OSV:PYSEC-2024-242...

PT-2024-22849 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions 2.9.2 through 2.11.2 Description: A Local File Inclusion LFI issue was identified, arising from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker c...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow that stems from the ability to create multiple models with the same name using URL encoding, potentially leading to a denial of service...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +164 more potentially affected by CVE-2024-37061 via mlflow (>=1.11.0 <=2.13.1)

mlflow PYPI version =1.11.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.2.5, =0.1.3, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.0.0 and more Source cves: CVE-2024-37061 Source advisory: OSV:GHSA-PQCV-QW2R-R859...

autorad (=0.2.6), bernn (>=0.1.3 <=0.3.2) +31 more potentially affected by CVE-2024-37057 via mlflow (>=2.0.0rc0 <=2.14.1)

mlflow PYPI version =2.0.0rc0, =0.1.3, =1.2.0, =0.8.0, =0.0.10, =1.0.0, =0.0.1, =0.1.0, =1.10.2, =0.1.2, =1.2.7, =1.6.1, =0.2.9, =0.3.0 - llm-foundry =0.9.0 and more Source cves: CVE-2024-37057 Source advisory: OSV:GHSA-J8MG-PQC5-X9GJ...

a2 (>=0.1.0 <=0.3.17), abadpour (>=6.13.1 <=7.24.1) +946 more potentially affected by CVE-2024-37059 via mlflow (>=0.8.2 <=3.4.0)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.0.5, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils =0.1.0a1 - ailine-core =0.5.5 and more Source cves: CVE-2024-37059 Source advisory: OSV:GHSA-WF7F-8FXF-XFXC...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +130 more potentially affected by CVE-2024-37055 via mlflow (>=1.24.0 <=2.14.1)

mlflow PYPI version =1.24.0, =0.1.0, =0.0.5, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37055 Source advisory: OSV:GHSA-X38X-G6GR-JQFF...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +131 more potentially affected by CVE-2024-37056 via mlflow (>=1.23.0 <=2.14.1)

mlflow PYPI version =1.23.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37056 Source advisory: OSV:GHSA-7P8J-QV6X-F4G4...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37055

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

PT-2024-27273

Name of the Vulnerable Software and Affected Versions MLflow versions 2.5.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user's system when interacted with. Recommendations F...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +150 more potentially affected by CVE-2024-4263 via mlflow (>=0.8.2 <=2.10.0)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +162 more potentially affected by CVE-2024-3848 via mlflow (>=0.8.2 <=2.11.3)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-3848 Source advisory: OSV:PYSEC-2024-244...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +150 more potentially affected by CVE-2024-4263 via mlflow (>=0.8.2 <=2.10.0)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-4263 Source advisory: OSV:PYSEC-2024-51...

CVE-2024-4263 Improper Access Control in mlflow/mlflow

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow version 2.11.0, which stems from insufficient validation of the fragment portion of a URL, leading to the reading of arbitrary files via path traversal...

Mlflow Path Traversal Vulnerability (CNVD-2024-35608)

Mlflow is an open source platform for the machine learning lifecycle. Mlflow version 2.9.2 suffers from a path traversal vulnerability that stems from insufficient validation of user-supplied input. An attacker exploiting this vulnerability could access arbitrary files on the server...