1618 matches found
GHSA-GMJ6-6F8F-6699 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, nemo, py3-jinja2, reflex, dask-gateway, ansible-operator, mlflow, emissary, kubeflow-jupyter-web-app, checkov, kserve, airflow, apache-beam-python-3.11-sdk, superset, localstack...
CVE-2024-56201 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, nemo, py3-jinja2, reflex, dask-gateway, ansible-operator, mlflow, emissary, kubeflow-jupyter-web-app, checkov, kserve, airflow, apache-beam-python-3.11-sdk, superset, localstack...
Local Privilege Escalation
MLflow is vulnerable to Local Privilege Escalation. The vulnerability is due to excessive directory permissions, allowing a Time-of-Check to Time-of-Use ToCToU attack when the sparkudf MLflow API is called...
Researchers Uncover Flaws in Popular Open-Source Machine Learning Frameworks
Cybersecurity researchers have disclosed multiple security flaws impacting open-source machine learning ML tools and frameworks such as MLflow, H2O, PyTorch, and MLeap that could pave the way for code execution. The vulnerabilities, discovered by JFrog, are part of a broader collection of 22...
BIT-MLFLOW-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
MLflow's excessive directory permissions allow local privilege escalation
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
GHSA-QPGC-W4MG-6V92 MLflow's excessive directory permissions allow local privilege escalation
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to excessive...
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
PYSEC-2024-224
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
CVE-2024-27134
CVE-2024-27134 : Multiple connected sources confirm a vulnerability in MLflow’s spark_udf API where excessive directory permissions allow a local attacker to achieve privilege escalation via a ToCToU attack. Affected: MLflow (spark_udf path) with local execution context. Root cause: insufficient ...
CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
MLflow 安全漏洞
MLflow is an open source platform from MLflow that simplifies machine learning development, including tracking experiments, packaging code into repeatable runs, and sharing and deploying models. A security vulnerability exists in MLflow that stems from excessive directory permissions that can lea...
PT-2024-21667 · Mlflow · Mlflow
Name of the Vulnerable Software and Affected Versions: MLflow affected versions not specified Description: The issue concerns excessive directory permissions in MLflow, which can lead to local privilege escalation when using spark udf. This behavior can be exploited by a local attacker to gain...
CVE-2024-27134: Time-of-check Time-of-use (TOCTOU) Race Condition
Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...
MLflow < 2.9.2 Path Traversal Vulnerability
Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 Tenable, Inc. include'compat.inc'; if description scriptid210769;...
