Rezultati pretraživanja za 'Proizvođač: zenml'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2025-8406 | 6.3 | ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and | 2025-10-30 14:08:25 | 2025-10-05 09:15:31 |
| CVE-2024-2213 | 3.3 | An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. | 2025-10-15 13:15:42 | 2024-06-06 19:15:53 |
| CVE-2024-2035 | 6.5 | An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing | 2025-10-15 13:15:42 | 2024-06-06 19:15:53 |
| CVE-2024-9340 | 7.5 | A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart bound | 2025-07-15 11:15:24 | 2025-03-20 10:15:48 |
| CVE-2024-2260 | 4.2 | A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token | 2025-06-12 23:48:17 | 2024-04-16 00:15:11 |
| CVE-2024-25723 | 8.8 | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new pass | 2025-05-12 13:29:53 | 2024-02-27 15:15:07 |
| CVE-2024-2083 | 9.9 | A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, | 2025-05-12 13:12:08 | 2024-04-16 00:15:11 |
| CVE-2024-4311 | 5.4 | zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the us | 2025-05-07 13:48:33 | 2024-11-14 18:15:19 |
| CVE-2024-28424 | 8.8 | zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file. | 2025-05-05 17:53:36 | 2024-03-14 19:15:50 |
| CVE-2024-2383 | 4.3 | A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the | 2024-10-11 15:11:36 | 2024-06-06 19:15:54 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/2
Zapisa po stranici: