deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28056
Published: 2024-04-15
Description: Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://aws.amazon.com/security/security-bulletins/AWS-2024-003/; https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json; https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1
CVE: CVE-2024-2659
Published: 2024-04-15
Description: 
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a specific administrative function.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.lenovo.com/us/en/product_security/LEN-140420; https://support.lenovo.com/us/en/product_security/LEN-140420
CVE: CVE-2024-31219
Published: 2024-04-15
Description: Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse-reactions/commit/6a5a8dacd7e5cbbbbe7d2288b1df9c1062994dbe; https://github.com/discourse/discourse-reactions/security/advisories/GHSA-7cqc-5xrw-xh67; https://github.com/discourse/discourse-reactions/commit/6a5a8dacd7e5cbbbbe7d2288b1df9c1062994dbe
CVE: CVE-2024-24485
Published: 2024-04-15
Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2024-24485; https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2024-24485
CVE: CVE-2024-24486
Published: 2024-04-15
Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24486; https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24486
CVE: CVE-2024-24487
Published: 2024-04-15
Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBOOT SYSTEM command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24487; https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24487
CVE: CVE-2024-28556
Published: 2024-04-15
Description: SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to admin-manage-user.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xuanluansec/vul/blob/main/vul/1/README.md; https://github.com/xuanluansec/vul/issues/1; https://github.com/xuanluansec/vul/blob/main/vul/1/README.md
CVE: CVE-2024-28557
Published: 2024-04-15
Description: SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to update-admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xuanluansec/vul/blob/main/vul/2/README-SQL-2.md; https://github.com/xuanluansec/vul/issues/2; https://github.com/xuanluansec/vul/blob/main/vul/2/README-SQL-2.md
CVE: CVE-2024-28558
Published: 2024-04-15
Description: SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to admin/app/web_crud.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/xuanluansec/vul/blob/main/vul/sql/sql-3.md; https://github.com/xuanluansec/vul/issues/3#issue[PII_REDACTED]; https://github.com/xuanluansec/vul/blob/main/vul/sql/sql-3.md
CVE: CVE-2024-3803
Published: 2024-04-15
Description: A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/h0e4a0r1t/fDGPOeWeaSuyFrWh/blob/main/VESYSTEM%20Cloud%20desktop%20arbitrary%20file%20upload%20vulnerability_fileupload.php.pdf; https://vuldb.com/?ctiid.260776; https://vuldb.com/?id.260776
CVE: CVE-2023-45503
Published: 2024-04-15
Description: SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://docs.google.com/spreadsheets/d/1AzXspN8oBAJ80YQxfN44bpbOuNzA3PZEccQ6IGQMs5E/edit?usp=sharing; https://github.com/ally-petitt/CVE-2023-45503?tab=readme-ov-file; https://docs.google.com/spreadsheets/d/1AzXspN8oBAJ80YQxfN44bpbOuNzA3PZEccQ6IGQMs5E/edit?usp=sharing
CVE: CVE-2024-23560
Published: 2024-04-15
Description: HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. 

CVSS Score: 4.4 (MEDIUM)
CWE: CWE-281
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111925; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111925
CVE: CVE-2024-30840
Published: 2024-04-15
Description: A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromDhcpListClient_list1.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromDhcpListClient_list1.md
CVE: CVE-2024-31497
Published: 2024-04-15
Description: In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forwarding mechanism. In other words, an adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions. After a key compromise, an adversary may be able to conduct supply-chain attacks on software maintained in Git. A second, independent scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. If the other services include Git services, then again it may be possible to conduct supply-chain attacks on software maintained in Git. This also affects, for example, FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338, CWE-338
References: http://www.openwall.com/lists/oss-security/2024/04/15/6; https://bugzilla.redhat.com/show_bug.cgi?id=2275183; https://bugzilla.suse.com/show_bug.cgi?id=1222864
CVE: CVE-2024-31990
Published: 2024-04-15
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

CVSS Score: 4.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c; https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5; https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
CVE: CVE-2024-32035
Published: 2024-04-15
Description: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.  This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands; https://docs.sixlabors.com/articles/imagesharp/security.html; https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3
CVE: CVE-2024-32036
Published: 2024-04-15
Description: ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-226, CWE-212
References: https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68; https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba; https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr
CVE: CVE-2024-3804
Published: 2024-04-15
Description: A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/h0e4a0r1t/QmzrAacbbUCsUNJm/blob/main/VESYSTEM%20Cloud%20desktop%20arbitrary%20file%20upload%20vulnerability_fileupload2.php.pdf; https://vuldb.com/?ctiid.260777; https://vuldb.com/?id.260777
CVE: CVE-2024-23558
Published: 2024-04-15
Description: HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-290
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923
CVE: CVE-2024-23561
Published: 2024-04-15
Description: HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values. 

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111926; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111926
CVE: CVE-2024-31648
Published: 2024-04-15
Description: Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at /core/new_category2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31648.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31648.md
CVE: CVE-2024-31649
Published: 2024-04-15
Description: A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31649.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31649.md
CVE: CVE-2024-31650
Published: 2024-04-15
Description: A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31650.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31650.md
CVE: CVE-2024-31652
Published: 2024-04-15
Description: A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31652.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31652.md
CVE: CVE-2020-22539
Published: 2024-04-15
Description: An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://gist.github.com/s4fv4n/320f536a684650c6948433de8d53713c; https://gist.github.com/s4fv4n/320f536a684650c6948433de8d53713c
CVE: CVE-2024-2424
Published: 2024-04-15
Description: 
An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonrecoverable fault (MNRF) when malicious input is entered. If exploited, the availability of the device will be impacted, and a manual restart is required. Additionally, a malformed PTP packet is needed to exploit this vulnerability. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1667.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1667.html
CVE: CVE-2024-30656
Published: 2024-04-15
Description: An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20[PII_REDACTED]0110-1956 allows attackers to cause a Denial of Service (DoS) via a crafted deauth frame.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Yashodhanvivek/Firebolt-wristphone-vulnerability; https://github.com/Yashodhanvivek/Firebolt-wristphone-vulnerability
CVE: CVE-2024-31651
Published: 2024-04-15
Description: A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31651.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31651.md
CVE: CVE-2024-3493
Published: 2024-04-15
Description: 
A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices. 


CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html
CVE: CVE-2020-22540
Published: 2024-04-15
Description: Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/s4fv4n/0d7a5093886cf41d9c478166e4aeec64; https://gist.github.com/s4fv4n/0d7a5093886cf41d9c478166e4aeec64
CVE: CVE-2023-33806
Published: 2024-04-15
Description: Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://gist.github.com/s4fv4n/5a6374cf1dcad85226566eaa325a710d; https://gist.github.com/s4fv4n/5a6374cf1dcad85226566eaa325a710d
CVE: CVE-2024-27794
Published: 2024-04-15
Description: Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login error message on the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US; https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US
CVE: CVE-2024-0404
Published: 2024-04-16
Description: A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-915
References: https://github.com/mintplex-labs/anything-llm/commit/8cd3a92c660b202655d99bee90b2864694c99946; https://huntr.com/bounties/b4355bae-766a-4bb0-942b-607bc491b23d; https://github.com/mintplex-labs/anything-llm/commit/8cd3a92c660b202655d99bee90b2864694c99946
CVE: CVE-2024-0549
Published: 2024-04-16
Description: mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23
References: https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62; https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72; https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62
CVE: CVE-2024-1135
Published: 2024-04-16
Description: Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1; https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html; https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
CVE: CVE-2024-1183
Published: 2024-04-16
Description: An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4; https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c; https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
CVE: CVE-2024-1456
Published: 2024-04-16
Description: An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.
CVSS Score: 7.1 (HIGH)
CWE: CWE-840
References: https://huntr.com/bounties/7c1b7f27-52f3-4b4b-9d81-e277f5e0ab6b; https://huntr.com/bounties/7c1b7f27-52f3-4b4b-9d81-e277f5e0ab6b
CVE: CVE-2024-1483
Published: 2024-04-16
Description: A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d; https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d