ZenML unauthenticated DoS via Multipart Boundry

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-9340 · ADVISORY
• zenml-io/zenml commit cba152e · WEB
• pypa/advisory-database · WEB
• zenml-io/zenml · PACKAGE
• huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 · WEB
• GitHub Advisory GHSA-6gmf-2369-c76c · ADVISORY

zenml のその他の脆弱性

• CVE-2025-8406高 7.8ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within…
• CVE-2024-4311中 5.4zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An atta…
• CVE-2024-5062中 6.1A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improp…
• CVE-2024-4680高 8.8A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient sessio…
• CVE-2024-2383中 6.1A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriat…