CVE-2023-52147

CVE-2023-52147 concerns the WordPress plugin All In One WP Security & Firewall (AIOS)

CVE-2023-51667

CVE-2023-51667 affects the Rate my Post – WP Rating System WordPress plugin (

CVE-2023-51543

CVE-2023-51543 describes an Authentication Bypass by Spoofing in the WordPress plugin RegistrationMagic (Metagauss) that allows bypassing ACL constraints to access restricted functionality. Affected versions are RegistrationMagic up to 5.2.5.0 (version range stated as n/a through 5.2.5.0). The vu...

CVE-2023-51542

CVE-2023-51542 concerns Branda (WordPress White Label plugin by WPMU DEV). Affected versions are Branda: from n/a through 3.4.14. The issue is an authentication bypass by spoofing, allowing access to functionality not properly constrained by ACLs. The CVSS 3.1 vector yields a base score of 5.3 (M...

CVE-2023-51511

CVE-2023-51511 involves Booster Elite for WooCommerce (Pluggabl LLC) with an improper authentication vulnerability that allows accessing functionality not properly constrained by ACLs. Affected software: Booster Elite for WooCommerce prior to version 7.1.3. Public references indicate a base CVSS ...

CVE-2024-29170

Dell PowerScale OneFS versions 8.2.x–9.8.0.x are affected by a trust-management issue caused by hard-coded credentials. An adjacent-network, unauthenticated attacker could disclose network-traffic information and trigger a denial of service. The advisory/patch guidance in the connected documents ...

CVE-2024-37065

CVE-2024-37065 : The vulnerability affects the Python library skops (version 0.6 and later). It stems from unsafe/deserialization of untrusted data, allowing a maliciously crafted model to trigger arbitrary code execution when loaded on a user system. The available documents confirm the affected ...

CVE-2024-37064

The CVE-2024-37064 entry concerns a vulnerability in the ydata-profiling open-source library where insecure deserialization of untrusted data in versions 3.7.0 and newer can allow a malicious dataset to execute arbitrary code on an end user’s system when loaded. The issue is associated with Ydata...

CVE-2024-37063

CVE-2024-37063 is a cross-site scripting (XSS) vulnerability affecting the open-source library ydata-profiling (versions 3.7.0 and newer). The root cause, as cited by multiple sources, is insufficient sanitization of user-supplied inputs in reports, allowing malicious payloads to execute when a c...

CVE-2024-37062

The CVE-2024-37062 entry concerns deserialization of untrusted data in the ydata-profiling library. Affected software: ydata-profiling versions 3.7.0 and newer. Root cause: inadequate input validation in the loads function within serialize_report.py, enabling arbitrary code execution when loading...

CVE-2024-37061

MLflow CVE-2024-37061 affects MLflow platforms running version 1.11.0 or newer. A maliciously crafted MLproject can trigger remote code execution on an end user’s system when run. Multiple connected sources corroborate RCE related to MLflow projects input handling, including descriptions and advi...

CVE-2024-37060

The CVE-2024-37060 entry corresponds to a deserialization of untrusted data in MLflow 1.27.0 and newer, allowing a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. The root cause is described as unsafe pickle deserialization in the Recipe handling path (recip...

CVE-2024-37059

MLflow contains a deserialization vulnerability affecting versions 0.5.0 and later in the PyTorch integration (mlflow/pytorch/init .py _load_model), where untrusted model data can trigger arbitrary code execution when a PyFunc model is loaded. Reports from Veracode describe attacker-controlled pi...

CVE-2024-37058

CVE-2024-37058 describes a deserialization of untrusted data in MLflow platforms running version 2.5.0 or newer, allowing a maliciously uploaded Langchain AgentExecutor model to execute arbitrary code on an end user’s system during interaction. The connected documents corroborate this issue acros...

CVE-2024-4254

CVE-2024-4254 — gradio-app/gradio : The main branch deploy-website.yml workflow is vulnerable to secrets exfiltration due to improper authorization. The workflow explicitly checks out and executes code from a fork, enabling untrusted code to run in an environment with push access to the base repo...

CVE-2024-37057

MLflow vulnerability CVE-2024-37057 affects MLflow platform versions 2.0.0rc0 and later, where deserialization of untrusted data can occur during interaction with a maliciously uploaded TensorFlow model, allowing arbitrary code execution on an end user’s system. The issue is tied to how MLflow lo...

CVE-2024-37056

CVE-2024-37056 affects the MLflow platform (versions 1.23.0 and newer) and involves unsafe deserialization of untrusted data. According to the sources, uploading a LightGBM scikit-learn model can be deserialized when run or loaded, enabling arbitrary code execution on the end user’s system. The p...

CVE-2024-37055

CVE-2024-37055 involves the MLflow platform (v1.24.0+). The issue is a deserialization of untrusted data in the pmdarima model handling, specifically in the _load_model path of mlflow's pmdarima/init .py, which can allow code execution on an end user’s system when a malicious PyFunc model is inte...

CVE-2024-37054

CVE-2024-37054 affects MLflow and stems from a deserialization issue in mlflow.pyfunc.load_model that processes PyFunc models, allowing a maliciously crafted model to trigger arbitrary code execution when loaded or interacted with. Public details (NVD entry) indicate versions 0.9.0 and newer are ...

CVE-2024-37053

CVE-2024-37053 applies to MLflow platforms 1.1.0 and newer, where deserialization of untrusted data (a maliciously uploaded scikit-learn model) can cause arbitrary code execution when interacted with. Affected component is the MLflow model loading path (e.g., _load_model_from_local_file). Root ca...