CVE-2023-6753

CVE-2023-6753 is a path traversal vulnerability in mlflow/mlflow prior to 2.9.2. Affected software: mlflow/mlflow. Root cause: path traversal allowing access to files beyond the intended directory. Impact per CVE metrics: Confidentiality, Integrity, and Availability high. Exploitation details and...

CVE-2023-6753 Path Traversal in mlflow/mlflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6753 Path Traversal in mlflow/mlflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

Mlflow Path Traversal Vulnerability

Mlflow is an open source platform for machine learning lifecycles. A path traversal vulnerability exists in Mlflow versions prior to 2.9.2, which stems from the ability to write arbitrary files while loading a dataset...

CVE-2023-6753: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

Jinja2 template injection in mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

GHSA-CXFR-5Q3R-2RC2 Jinja2 template injection in mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.9.2 that stems from incorrect neutralization of special elements used in the template engine...

PT-2023-32757 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to Path Traversal in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 or later to resolve the issue...

CVE-2023-6709: Improper Neutralization of Special Elements Used in a Template Engine

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PT-2023-32744 · Jinja2 +1 · Jinja2 +1

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to improper neutralization of special elements used in a template engine. This can lead to remote code execution due to jinja2 SSTI in MLflow. Recommendations: For versio...

Cross Site Scripting (XSS)

mlflow is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of proper sanitization and escaping of user inputs in the Content-Type header of POST requests. An attacker can exploit this vulnerability to injecting malicious code into the header, which will then be...

GHSA-VWHF-3V6X-WFF8 Cross-site Scripting (XSS) in MLflow

A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...

Cross-site Scripting (XSS) in MLflow

A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...