https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:32:25 +0000 https://cve.radiocsirt.org/vuln/cve-2024-2928 <p><strong>Affected:</strong> mlflow/mlflow, lfprojects mlflow</p> <p>A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application&#39;s failure to properly validate URI fragments for directory traversal sequences such as &#39;../&#39;. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like &#39;/etc/passwd&#39;. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI&#39;s query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.</p> <p><strong>Affected:</strong> mlflow/mlflow, lfprojects mlflow</p> <p>A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application&#39;s failure to properly validate URI fragments for directory traversal sequences such as &#39;../&#39;. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like &#39;/etc/passwd&#39;. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI&#39;s query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.</p> https://cve.radiocsirt.org/vuln/cve-2024-2928 https://cve.radiocsirt.org/vuln/ghsa-j46q-5pxx-8vmw <p><strong>Affected:</strong> PyPI: mlflow</p> <p>A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application&#39;s failure to properly validate URI fragments for directory traversal sequences such as &#39;../&#39;. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like &#39;/etc/passwd&#39;. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI&#39;s query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.</p> <p><strong>Affected:</strong> PyPI: mlflow</p> <p>A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application&#39;s failure to properly validate URI fragments for directory traversal sequences such as &#39;../&#39;. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like &#39;/etc/passwd&#39;. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI&#39;s query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-j46q-5pxx-8vmw