PYSEC-2024-288

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

CVE-2024-3575

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

CVE-2024-3575

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

PYSEC-2024-288

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

CVE-2024-3575 Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

CVE-2024-3575 Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb

Cross-site Scripting XSS - Stored in mindsdb/mindsdb...

PT-2024-26703 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: mindsdb/mindsdb affected versions not specified Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. When a user uploads a csv file containing a JavaScript payload, the XSS is triggered when the file is...

MindsDB 跨站脚本漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. MindsDB suffers from a cross-site scripting vulnerability. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute...

CVE-2023-50731

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

PYSEC-2023-279

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

Path traversal

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

PYSEC-2023-279

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

CVE-2023-50731 MindsDB has arbitrary file write in file.py

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

CVE-2023-50731 MindsDB has arbitrary file write in file.py

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

CVE-2023-50731

CVE-2023-50731 – MindsDB : The vulnerability arises in mindsdb/mindsdb/api/http/namespaces/file.py, where the PUT path does not validate the user-controlled name used for a temporary file. This leads to path injection, allowing arbitrary file writes via f.write(chunk) and potential write outside ...

MindsDB Code Issues Vulnerabilities

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A code issue vulnerability exists in versions prior to MindsDB 23.11.4.1 that stems from not validating user-controlled name values, potentially leading to path injection...

Arbitrary File Write

mindsdb is vulnerable to Arbitrary File Write. The vulnerability is due improper filename sanitization within file.py. This issue can be exploited by an attacker to write arbitrary files to the filesystem...

GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182

Impact Issue: Arbitrary file write in file.py GHSL-2023-183 Patches Use mindsdb staging branch or v23.11.4.1...

GHSA-J8W6-2R9H-CXHJ GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182

Impact Issue: Arbitrary file write in file.py GHSL-2023-183 Patches Use mindsdb staging branch or v23.11.4.1...

PT-2023-31629 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions prior to 23.11.4.1 Description: The issue concerns a path injection vulnerability in the put method of mindsdb/mindsdb/api/http/namespaces/file.py. This vulnerability allows arbitrary file contents to be written due to the la...