CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 23/02/2024 |
| CVE-2024-27132 | 緊急9.6 | Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook.
The vulnerability stems from lack of sanitization over template variables.
| 23/02/2024 |
| CVE-2023-6977 | 高7.5 | This vulnerability enables malicious users to read sensitive files on the server. | 20/12/2023 |
| CVE-2023-6976 | 高8.8 | This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process. | 20/12/2023 |
| CVE-2023-6975 | 緊急9.8 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. | 20/12/2023 |
| CVE-2023-6974 | 緊急9.8 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine. | 20/12/2023 |
| CVE-2023-6940 | 高8.8 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. | 19/12/2023 |
| CVE-2023-6909 | 高7.5 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. | 18/12/2023 |
| CVE-2023-6831 | 高8.1 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. | 15/12/2023 |
| CVE-2023-6753 | 高8.8 | Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. | 13/12/2023 |
| CVE-2023-6709 | 高8.8 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. | 12/12/2023 |
| CVE-2023-6568 | 中6.1 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate s | 07/12/2023 |
| CVE-2023-43472 | 高7.5 | An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. | 05/12/2023 |
| CVE-2023-6014 | 緊急9.8 | An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. | 16/11/2023 |
| CVE-2023-6018 | 緊急9.8 | An attacker can overwrite any file on the server hosting MLflow without any authentication. | 16/11/2023 |
| CVE-2023-6015 | 高7.5 | MLflow allowed arbitrary files to be PUT onto the server. | 16/11/2023 |
| CVE-2023-4033 | 高7.8 | OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. | 01/08/2023 |
| CVE-2023-3765 | 緊急10.0 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. | 19/07/2023 |