MLflow vulnerabilities
89 CVEs and advisories name MLflow as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-37052Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously upload
- CVE-2024-4263Improper Access Control in mlflow/mlflow
- CVE-2024-3848Path Traversal Bypass in mlflow/mlflow
- CVE-2024-3573Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow
- CVE-2024-1558Path Traversal Vulnerability in mlflow/mlflow
- CVE-2024-1594Local File Read via Path Traversal in mlflow/mlflow
- CVE-2024-1593Path Traversal via Parameter Smuggling in mlflow/mlflow
- CVE-2024-1483Path Traversal Vulnerability in mlflow/mlflow
- CVE-2024-1560Path Traversal Vulnerability in mlflow/mlflow
- CVE-2023-6977Path Traversal: '\..\filename'
- CVE-2023-6976Unrestricted Upload of File with Dangerous Type
- CVE-2023-6975Path Traversal: '\..\filename'
- CVE-2023-6974Server-Side Request Forgery (SSRF)
- CVE-2023-6940Command Injection
- CVE-2023-6909Path Traversal: '\..\filename' in mlflow/mlflow
- CVE-2023-6831Path Traversal: '\..\filename' in mlflow/mlflow
- CVE-2023-6753Path Traversal in mlflow/mlflow
- CVE-2023-6709Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
- CVE-2023-6568Reflected XSS via Content-Type Header in mlflow/mlflow
- CVE-2023-6014MLflow Authentication Bypass
- CVE-2023-6015MLflow Arbitrary File Upload
- CVE-2023-6018MLflow Arbitrary File Write
- CVE-2023-4033OS Command Injection in mlflow/mlflow
- CVE-2023-3765Absolute Path Traversal in mlflow/mlflow
- CVE-2023-2780Path Traversal: '\..\filename' in mlflow/mlflow
- CVE-2023-2356Relative Path Traversal in mlflow/mlflow
- CVE-2023-1177Path Traversal: '\..\filename' in mlflow/mlflow
- CVE-2023-1176Absolute Path Traversal in mlflow/mlflow
- CVE-2022-0736Insecure Temporary File in mlflow/mlflow