231554 matches found
CVE-2024-37061
MLflow CVE-2024-37061 affects MLflow platforms running version 1.11.0 or newer. A maliciously crafted MLproject can trigger remote code execution on an end user’s system when run. Multiple connected sources corroborate RCE related to MLflow projects input handling, including descriptions and advi...
CVE-2024-37060
The CVE-2024-37060 entry corresponds to a deserialization of untrusted data in MLflow 1.27.0 and newer, allowing a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. The root cause is described as unsafe pickle deserialization in the Recipe handling path (recip...
CVE-2024-37059
MLflow contains a deserialization vulnerability affecting versions 0.5.0 and later in the PyTorch integration (mlflow/pytorch/init .py _load_model), where untrusted model data can trigger arbitrary code execution when a PyFunc model is loaded. Reports from Veracode describe attacker-controlled pi...
CVE-2024-37058
CVE-2024-37058 describes a deserialization of untrusted data in MLflow platforms running version 2.5.0 or newer, allowing a maliciously uploaded Langchain AgentExecutor model to execute arbitrary code on an end user’s system during interaction. The connected documents corroborate this issue acros...
CVE-2024-4254
CVE-2024-4254 — gradio-app/gradio : The main branch deploy-website.yml workflow is vulnerable to secrets exfiltration due to improper authorization. The workflow explicitly checks out and executes code from a fork, enabling untrusted code to run in an environment with push access to the base repo...
CVE-2024-37057
MLflow vulnerability CVE-2024-37057 affects MLflow platform versions 2.0.0rc0 and later, where deserialization of untrusted data can occur during interaction with a maliciously uploaded TensorFlow model, allowing arbitrary code execution on an end user’s system. The issue is tied to how MLflow lo...
CVE-2024-37056
CVE-2024-37056 affects the MLflow platform (versions 1.23.0 and newer) and involves unsafe deserialization of untrusted data. According to the sources, uploading a LightGBM scikit-learn model can be deserialized when run or loaded, enabling arbitrary code execution on the end user’s system. The p...
CVE-2024-37055
CVE-2024-37055 involves the MLflow platform (v1.24.0+). The issue is a deserialization of untrusted data in the pmdarima model handling, specifically in the _load_model path of mlflow's pmdarima/init .py, which can allow code execution on an end user’s system when a malicious PyFunc model is inte...
CVE-2024-37054
CVE-2024-37054 affects MLflow and stems from a deserialization issue in mlflow.pyfunc.load_model that processes PyFunc models, allowing a maliciously crafted model to trigger arbitrary code execution when loaded or interacted with. Public details (NVD entry) indicate versions 0.9.0 and newer are ...
CVE-2024-37053
CVE-2024-37053 applies to MLflow platforms 1.1.0 and newer, where deserialization of untrusted data (a maliciously uploaded scikit-learn model) can cause arbitrary code execution when interacted with. Affected component is the MLflow model loading path (e.g., _load_model_from_local_file). Root ca...
CVE-2024-37052
The CVE-2024-37052 issue affects MLflow platforms running version 1.1.0 or newer. The root cause is deserialization of untrusted data during model handling, as described by multiple connected sources, including reports that an uploaded scikit-learn model can be crafted to trigger arbitrary code e...
CVE-2023-49852
CVE-2023-49852 concerns the Vsourz Digital Responsive Slick Slider WordPress plugin (
CVE-2023-49774
CVE-2023-49774 concerns the WordPress plugin WP Photo Album Plus (versions up to 8.5.02.005). The Red Hat/NVD entries describe an Information Exposure/Bypass issue where unauthenticated users could bypass login protection by manipulating IP-related behavior. PatchStack confirms the vulnerability ...
CVE-2023-49748
CVE-2023-49748 affects the WP Hide Login plugin (WordPress) up to version 1.9.11. The vulnerability is described as a Secret Login Page Location Disclosure on multisite installations, enabling exposure of login functionality due to ACLs not constraining access as intended. It has a low overall im...
CVE-2023-49741
CVE-2023-49741 affects the WordPress plugin Coming Soon and Maintenance mode (
CVE-2023-48753
CVE-2023-48753 covers a WordPress plugin issue in “Restricted Site Access” where IP address-based access control can be bypassed via IP spoofing. Affected plugin: Restricted Site Access (WordPress) up to and including version 7.4.1. The root cause is insufficient restriction of how IP information...
CVE-2023-48747
CVE-2023-48747 affects Booster for WooCommerce (WordPress plugin)
CVE-2023-48745
CVE-2023-48745 affects the WordPress plugin Captcha Code by WebFactory Ltd. It is caused by improper restriction of excessive authentication attempts, enabling a bypass of captcha protection. Affected versions are
CVE-2023-48335
The CVE-2023-48335 entry describes a vulnerability in the WordPress plugin Hide login page (versions up to 1.1.9) where an unauthenticated actor can access the login functionality due to ACL constraints being bypassed. The underlying issue is a location disclosure/bypass that exposes a login page...