GHSA-CXFR-5Q3R-2RC2 Jinja2 template injection in mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

Input validation

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709

CVE-2023-6709 affects mlflow/mlflow up to version 2.9.1 (prior to 2.9.2). The issue is improper neutralization of special elements used in a template engine (Jinja2), enabling template injection with potential arbitrary code execution. Affected component: mlflow/mlflow templates; root cause: inse...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2023-3270)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2023-3299)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALSA-2023:7762 Moderate: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-29409 golang: html/template:...

RHEL 9 : skopeo (RHSA-2023:7762)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7762 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...

ALSA-2023:7764 Moderate: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.9.2 that stems from incorrect neutralization of special elements used in the template engine...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2023-3331)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-49964

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE...

CVE-2023-49964

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE...

Alfresco Community Edition Security Vulnerability

Alfresco Community Edition is the U.S. Alfresco's set of open source enterprise content management system community edition. The system includes document management, office collaboration, and other features. A security vulnerability exists in Alfresco Community Edition 7.2.0 and earlier versions,...

PT-2023-32744 · Jinja2 +1 · Jinja2 +1

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to improper neutralization of special elements used in a template engine. This can lead to remote code execution due to jinja2 SSTI in MLflow. Recommendations: For versio...

CVE-2023-49964

Hyland Alfresco Community Edition (up to v7.2.0) is affected by CVE-2023-49964 due to an SSTI flaw in the folder.get.html.ftl FreeMarker template. An attacker who can insert malicious content into that template may leverage FreeMarker exposed objects to bypass restrictions and achieve Remote Code...