Improper Access Control in mlflow/mlflow

Authorization Bypass in SearchModelVersions in mlflow/mlflow

A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password

Stored XSS via unsafe YAML parsing in MLflow

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any…

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a…

Authorization Bypass in MLflow AJAX Endpoint