ZenML Security Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A security vulnerability exists in ZenML that stems from a failure to set the appropriate X-Frame-Options or Content-Security-Policy HTTP header due to an application failure,...

PT-2024-18651

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.55.3 Description An improper authorization issue exists in the zenml-io/zenml repository, specifically within the API "PUT /api/v1/users/id" endpoint. This issue allows any authenticated user to modify the information ...

ZenML Security Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A security vulnerability exists in ZenML version 0.55.3, which stems from an improper authorization vulnerability in the API PUT /api/v1/users/id endpoint that allows an attacker...

CVE-2024-2032: Race Condition within a Thread

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of...

PT-2024-19218

Name of the Vulnerable Software and Affected Versions zenml-io/zenml versions up to and including 0.55.4 Description An issue was discovered due to improper authentication mechanisms, allowing an attacker with access to an active user session to change the account password without knowing the...

CVE-2024-2383: Improper Restriction of Rendered UI Layers or Frames

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious...

ZenML Cross-Site Scripting Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A cross-site scripting vulnerability exists in ZenML version 0.55.3, which stems from a stored cross-site scripting XSS vulnerability in the logourl field that allows an attacker...

CVE-2024-2171: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logourl' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The...

CVE-2024-2035: Missing Authorization

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false,...

ZenML Security Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A security vulnerability exists in ZenML versions 0.55.3 and below, which stems from the presence of a contention condition vulnerability that leads to data inconsistency and...

ZenML Detection

Binary data zenmldetect.nbin...

Session Fixation

Zenml-io/zenml is vulnerable to session fixation. The vulnerability is due to JWT tokens used for user authentication not being invalidated upon logout, allowing an attacker to reuse a victim's JWT token to bypass authentication mechanisms...

ZenML Authorization Issue Vulnerability (CNVD-2024-20268)

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. An authorization issue vulnerability exists in ZenML 0.55.4 and prior versions of the application that stems from the presence of session fixation, which can be exploited by an...

ZenML Directory Traversal Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A directory traversal vulnerability exists in ZenML version 0.55.4, which stems from a lack of validity checking of a program's paths when processing directory requests, and can ...

zenml Session Fixation vulnerability

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token...

Directory traversal in zenml

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...

GHSA-G3R5-72HF-P7P2 zenml Session Fixation vulnerability

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token...

GHSA-6H3F-43VQ-53HJ Directory traversal in zenml

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...

CVE-2024-2083

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...

CVE-2024-2260

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token...