CVE-2024-6838

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838

CVE-2024-6838 affects mlflow/mlflow v2.13.2, allowing creation or renaming of an experiment with an unbounded number of integers in the name and no limit on the artifact_location, leading to potential denial of service due to UI unresponsiveness (uncontrolled resource consumption). The vulnerabil...

PT-2025-12167

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version v2.13.2 Description A potential denial of service issue exists due to the lack of a limit on the experiment name, allowing the creation or renaming of an experiment with a large number of integers in its name. This can...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.19.3, which stems from an unvalidated path to the tarfile.extractall function and could lead to arbitrary file extraction and overwriting...

MLflow 安全漏洞

MLflow is an open source platform from MLflow that simplifies machine learning development, including tracking experiments, packaging code into repeatable runs, and sharing and deploying models. A security vulnerability exists in MLflow version v2.13.2, which stems from an unrestricted experiment...

CVE-2024-57889 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from invalid context at...

Malicious code in tracking-protection-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7e3c4e6767c5b9de18b97979fd15fbe90fdc3b01d78bb3ce044f224e588787a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.24 and earlier versions, which stems from an incorrect manipulation of the parameter query that can lead to cross-site scripting attacks...

GHSA-3MWC-2CJ7-GX8C lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management

Withdrawn: This advisory was incorrectly linked the the npm package lunary. The advisory is valid, but not for that package. In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datase...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...

GHSA-M49C-5C52-6696 mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...

IoC detection experiments with ChatGPT

ChatGPT is a groundbreaking chatbot powered by the neural network-based language model text-davinci-003 and trained on a large dataset of text from the Internet. It is capable of generating human-like text in a wide range of styles and formats. ChatGPT can be fine-tuned for specific tasks, such a...

PT-2023-12419 · Unknown · Nyuccl Psiturk

Name of the Vulnerable Software and Affected Versions: NYUCCL psiTurk versions up to 3.2.0 Description: A critical issue has been found in NYUCCL psiTurk, affecting unknown code of the file psiturk/experiment.py. The manipulation of the mode argument leads to improper neutralization of special...

The US May Soon Learn What a ‘Kid-Friendly’ Internet Looks Like

The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children...

Malicious code in webext-experiment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2d468aa93a14febc9fa5b285255c1a223fa9abd1aa0e614c6dbe3a57a18f412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7092 Malicious code in webext-experiment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2d468aa93a14febc9fa5b285255c1a223fa9abd1aa0e614c6dbe3a57a18f412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-313 Malicious code in @harrysforge/gatsby-theme-experiment-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e54e93376c3ca31dfee91c73665439b55cb00e252cd60fba6a27453eabfebdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...