ZenML < 0.55.5 Vulnerability - CVE-2024-2032

The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a race condition vulnerability which allows for the creation of multiple users with the same username when requests are sent in parallel. The vulnerability arises due to insufficient handling of...

Account Takeover

zenml is vulnerable to Account Takeover. The vulnerability is due to a lack of rate-limiting on the '/api/v1/current-user' endpoint, which allows attackers to brute-force the current password in the 'Update Password' function...

Improper Authentication

zenml is vulnerable to Improper Authentication. The vulnerability is due to improper authentication mechanisms, allowing an attacker with access to an active user session to change the account password without knowing the current password, bypassing the standard password change verification proce...

ZenML Security Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A security vulnerability exists in ZenML versions 0.55.3 and below, which stems from the presence of a contention condition vulnerability that leads to data inconsistency and...

ZenML 授权问题漏洞

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. An authorization issue vulnerability exists in ZenML 0.55.4 and prior versions of the application that stems from the presence of session fixation, which can be exploited by an...

PT-2024-18737 · Zenml · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml affected versions not specified Description: A directory traversal issue exists, specifically within the "/api/v1/steps" endpoint. Attackers can exploit this by manipulating the logs URI path to fetch arbitrary file content,...

CVE-2024-28424

zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpicklematerializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...