Vendor
MLflow
90 known vulnerabilities.
Products
90 results · Feed
-
Critical 9.1
MLflow Authentication Bypass
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
-
Critical 10.0
MLflow Arbitrary File Upload
MLflow allowed arbitrary files to be PUT onto the server.
-
Critical 10.0
MLflow Arbitrary File Write
An attacker can overwrite any file on the server hosting MLflow without any authentication.
-
High 8.8
OS Command Injection in mlflow/mlflow
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
-
Critical 10.0
Absolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
-
Critical 9.8CVE-2023-2780 Scanner template
Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
-
Critical 10.0CVE-2023-2356 Scanner template
Relative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
-
Medium 5.3
Absolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
-
Critical 9.3
Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
-
High 8.2
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.