Product:

Mlflow

(Lfprojects)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 46
Date Id Summary Products Score Patch Annotated
2024-06-04 CVE-2024-37061 Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run. Mlflow 8.8
2024-11-25 CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called. Mlflow 7.0
2023-05-11 CVE-2023-30172 A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter. Mlflow 7.5
2024-05-16 CVE-2024-3848 A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read... Mlflow 7.5
2024-02-23 CVE-2024-27132 Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables. Mlflow 9.6
2024-02-23 CVE-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields. Mlflow 9.6
2022-02-23 CVE-2022-0736 Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. Mlflow 7.5
2023-03-24 CVE-2023-1176 Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. Mlflow 3.3
2023-03-24 CVE-2023-1177 Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Mlflow 9.8
2023-04-28 CVE-2023-2356 Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. Mlflow 7.5