CVE-2022-0736: Insecure Temporary File

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1...

Insecure Temporary File in mlflow/mlflow

Description mlflow package is using the deprecated function tempfile.mktemp which is not secure. Because a different process may create a file with this name in the time between the call to mktemp and the subsequent attempt to create the file by the first process. Impact Availability will get...

async-metronome (0.2.0), bach (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2020-35926 via nanorand (0.4.4)

nanorand CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - async-metronome 0.2.0 - bach =0.0.1, =0.1.0, =0.1.0, =0.4.7, =0.1.0, =0.1.1 Source cves: CVE-2020-35926 Source advisory: GHSA-M9M5-CG5H-R582...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.databand:dbnd-agent (>=0.42.1, <=0.80.6) +5759 more potentially affected by CVE-2019-12086 via com.fasterxml.jackson.core:jackson-databind (>=2.7.0, <=2.7.9.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.7.0, =0.3.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =0.2, =0.8.0, =3.3.3, =0.0.1, =0.0.2, =0.0.3 - at.ac.ait.lablink.clients:sync 0.0.1 - at.ac.ait.lablink:core 0.0.1 and more Source cves: CVE-2019-12086 Source advisory: MEND:CVE-2019-1208...