a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6831 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

GHSA-554W-XH4J-8W64 Path traversal in MLflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6753 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

GHSA-V945-R3RC-6FJM Path traversal in MLflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6753 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6753 Source advisory: OSV:PYSEC-2023-309...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6709 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6709 Source advisory: OSV:GHSA-CXFR-5Q3R-2RC2...

MLFlow Security Vulnerability

Mlflow is an open source platform for the machine learning lifecycle. A security vulnerability exists in MLFlow version 2.8.1 and prior versions. A remote attacker exploited the vulnerability to obtain sensitive information via a specially crafted REST API request...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +334 more potentially affected by CVE-2023-6014 via mlflow (>=0.8.2 <=2.7.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6014 Source advisory: OSV:GHSA-4QQ5-MXXX-M6GG...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +337 more potentially affected by CVE-2023-6015 via mlflow (>=0.8.2 <=2.8.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6018 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

GHSA-5P3H-7FWH-92RC Remote Code Execution due to Full Controled File Write in mlflow

The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...

PT-2023-32477

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows an attacker to arbitrarily create an account in MLflow, bypassing any authentication requirement. Recommendations At the moment, there is no information about a newer version...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycle. Mlflow has a security vulnerability that stems from allowing an unauthorized attacker to overwrite any file on MLflow's servers...

PT-2023-32481

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows an attacker to overwrite any file on the server hosting MLflow without authentication. This gives multiple ways to achieve code execution, such as overwriting /home//.bashrc. ...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +333 more potentially affected by CVE-2023-4033 via mlflow (>=0.8.2 <=2.5.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-4033 Source advisory: OSV:GHSA-FFW3-6378-CQGP...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +333 more potentially affected by CVE-2023-4033 via mlflow (>=0.8.2 <=2.5.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-4033 Source advisory: OSV:PYSEC-2023-280...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +329 more potentially affected by CVE-2023-3765 via mlflow (>=0.8.2 <=2.4.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +329 more potentially affected by CVE-2023-3765 via mlflow (>=0.8.2 <=2.4.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-3765 Source advisory: OSV:PYSEC-2023-308...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +321 more potentially affected by CVE-2023-2780 via mlflow (>=0.8.2 <=2.2.2)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...