Vulnerabilityhigh
Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-45187+3 related CVEs | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… | 8.8 group max | <1% | ||
| CVE-2024-5565 | The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run… | 8.1 | 15% | ||
| CVE-2024-6507 | Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API | 8.1 | 1% | ||
| CVE-2024-7340 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak… | 8.8 | 5% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Nov 11, 2024 Machine Learning / Vulnerability Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning (ML) related open-source projects. These comprise vulnerabilities discovered both on the server- and client-side, software supply chain security firm JFrog said in an analysis published last week.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.