Race Condition within a Thread

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Race Condition within a Thread in the ServiceConnectorRegistry class in serviceconnectorregistry.py, causing errors that block access to certain service connector types when concurrent...

Incorrect Authorization

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Incorrect Authorization due to improper RBAC enforcement. Remediation Upgrade zenml to version 0.72.0 or higher. References - GitHub Commit - GitHub PR...

ZenML < 0.56.3 Unpatched Session Expiration Exposure (CVE-2024-4680)

The version of ZenML installed on the remote host is prior to 0.56.3. It is, therefore, affected by a vulnerability which allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change,...

ZenML < 0.56.3 Vulnerability - CVE-2024-2213

The version of ZenML installed on the remote host is prior to 0.56.3. It is, therefore, affected by an improper authentication mechanisms. An attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for...

ZenML < 0.57.1 DoS (CVE-2024-4460)

The version of ZenML installed on the remote host is prior to 0.57.1. It is, therefore, affected by a denial of service DoS vulnerability exists in zenml-io/zenml version due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through th...

ZenML < 0.55.5 Vulnerability - CVE-2024-2032

The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a race condition vulnerability which allows for the creation of multiple users with the same username when requests are sent in parallel. The vulnerability arises due to insufficient handling of...

ZenML < 0.55.5 Arbitrary File Upload

The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by an arbitrary file upload vulnerability in the load function at /materializers/cloudpicklematerializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

ZenML < 0.58.0 XSS

The version of ZenML installed on the remote host is prior to 0.57.1. It is, therefore, affected by a A reflected Cross-Site Scripting XSS vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation,...

ZenML < 0.57.0 Password Reset Brute Force (CVE-2024-4311)

The version of ZenML installed on the remote host is prior to 0.57.0. It is, therefore, affected by an account takeover exposure due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to...

ZenML < 0.56.2 Vulnerability - CVE-2024-2035

The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by An improper authorization vulnerability exists in the API /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing th...

ZenML < 0.56.2 Vulnerability - CVE-2024-2171

The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability was identified within the 'logourl' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users,...

ZenML < 0.56.3 Vulnerability - CVE-2024-2383

The version of ZenML installed on the remote host is prior to 0.56.3. It is, therefore, affected by a clickjacking vulnerability due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the...

Account Takeover

zenml is vulnerable to Account Takeover. The vulnerability is due to a lack of rate-limiting on the '/api/v1/current-user' endpoint, which allows attackers to brute-force the current password in the 'Update Password' function...

Missing ratelimit on passwrod resets in zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

Allocation of Resources Without Limits or Throttling

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the /api/v1/current-user endpoint. An attacker can brute-force the current password in the Update Password function, allowing them...

CVE-2024-4311

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311 Lack of login attempt rate-limiting in zenml-io/zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311 Lack of login attempt rate-limiting in zenml-io/zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311

ZenML 0.56.4 is affected by CVE-2024-4311 due to no rate-limiting on the password-change flow, enabling brute-forcing of the current password via /api/v1/current-user and potentially taking over the user account. Affected component: password update function. Impact: account takeover with unauthen...