1355 matches found
PYSEC-2023-68
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
CVE-2023-2356 Relative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
CVE-2023-2356 Relative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
PT-2023-19040 · Mlflow · Mlflow
Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.3.1 Description: The issue is related to a Relative Path Traversal in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue...
CVE-2023-2356
CVE-2023-2356 is a Relative Path Traversal flaw in mlflow/mlflow before 2.3.1. The connected sources (Nuclei template, OSV entries, GHSA advisories) describe a vulnerability allowing traversal to read sensitive server files (LFI) via a crafted path. Affected software: mlflow/mlflow, versions prio...
CVE-2023-2356 Relative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
Mlflow 安全漏洞
Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.3.1. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...
Path Traversal
mlflow is vulnerable to Path Traversal. The vulnerability exists due to improper access control in handlers.py which allows an attacker to traverse outside the restricted directory and download arbitrary files on the server. Note that mlflow is only affected if it runs with either mlflow server o...
Path Traversal
mlflow is vulnerable to Path Traversal. The vulnerability exists due to filestore.py because it lacks adequate validation for model names with path separators, which allows an attacker to check if an arbitrary file exists on the server. The vulnerability is only applicable if the mlflow server or...
Local File Read Bypass in mlflow/mlflow
Description This is a bypass to the following submission which was assigned CVE-2023-1177. Proof of Concept Start the server or UI it works on both identically mlflow ui --host 127.0.0.1:5000 1. Create a Model named "AJAX-API". curl -i -s -k -X $'POST' -H $'Host: 127.0.0.1:5000' -H $'User-Agent:...
GHSA-WP72-7HJ9-5265 Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...
Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...
a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +318 more potentially affected by CVE-2023-1176 via mlflow (>=0.8.2 <=2.22.5)
mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-1176 Source advisory: OSV:GHSA-WP72-7HJ9-5265...
mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...
a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +318 more potentially affected by CVE-2023-1177 via mlflow (>=0.8.2 <=2.22.5)
mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-1177 Source advisory: OSV:GHSA-XG73-94FP-G449...
GHSA-XG73-94FP-G449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...
CVE-2023-1176
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...
CVE-2023-1177
Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...
