Vulnerabilities for zenml

First version without a known vulnerability: 0.68.0

Details

• GHSA-q92x-2x5g-h3652025-10-05

  ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

  Fixed in: 0.84.2

• GHSA-6gmf-2369-c76c2025-03-20

  ZenML unauthenticated DoS via Multipart Boundry

  Fixed in: 0.68.0, cba152eb9ca3071c8372b0b91c02d9d3351de48d

• GHSA-j3vq-pmp5-r5xj2024-11-14

  Missing ratelimit on passwrod resets in zenml

  Fixed in: 0.57.0rc2

• GHSA-3434-hc3m-8mmm2024-06-30

  Reflected Cross-Site Scripting (XSS) in zenml

  Fixed in: 0.58.0, 21edd863c0ba53c1110b6f018a07c2d6853cf6d4

• GHSA-7gjr-hcc3-xfr42024-06-24

  Improper line feed handling in zenml

  Fixed in: 0.57.1

• GHSA-99hm-86h7-gr3g2024-06-08

  zenml-io/zenml does not expire the session after password reset

• GHSA-9x88-4jg8-4vf72024-06-06

  Improper authorization in zenml

  Fixed in: 0.56.2, b95f083efffa56831cd41d8ed536aeb0b6038fa3

• GHSA-c546-8jmq-hprj2024-06-06

  Race condition in zenml

  Fixed in: 0.55.5, afcaf741ef9114c9b32f722f101b97de3d8d147b

• GHSA-j527-v579-m98h2024-06-06

  Improper authentication in zenml

  Fixed in: 0.56.3, 58cb3d987372c91eb605853c35325701733337c2

• GHSA-mq73-g4qr-fgcq2024-06-06

  Clickjacking in zenml

  Fixed in: 0.56.3, f863fde1269bc355951f8cfc826c0244d88ad5e9

• GHSA-vwgf-7f9h-h4992024-06-06

  Cross site scripting in zenml

  Fixed in: 0.56.2, 68bcb3ba60cba9729c9713a49c39502d40fb945e

• GHSA-6h3f-43vq-53hj2024-04-16

  Directory traversal in zenml

  Fixed in: 0.55.5

• GHSA-g3r5-72hf-p7p22024-04-16

  zenml Session Fixation vulnerability

  Fixed in: 0.56.2, 68bcb3ba60cba9729c9713a49c39502d40fb945e

• GHSA-vf7j-cmrj-pmmm2024-02-27

  ZenML Server Remote Privilege Escalation Vulnerability

  Fixed in: 0.42.2, 0.43.1, 0.46.7, 0.44.4