Read the docs

mindsdb

Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9

Exploited now

mindsdb records in CISA KEV

No mindsdb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mindsdb 22 records HIGH

Records

22 records in Mindsdb · all components

TI-2024-30805 CVE-2024-45849 · GHSA-c85f-pcx6-2ghm

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30804 CVE-2024-45848 · GHSA-9gq6-6936-885w

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00844 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30803 CVE-2024-45847 · GHSA-crmg-rp64-5cm3

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00851 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30802 CVE-2024-45846 · GHSA-wcjw-3v6p-4v3r

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02131 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30807 CVE-2024-45851 · GHSA-wf9g-c67g-h4ch

Code injection in mindsdb

Priority MEDIUM 42

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30806 CVE-2024-45850 · GHSA-v6g6-3cm3-vf6c

Code injection in mindsdb

Priority MEDIUM 42

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30812 CVE-2024-45856 · GHSA-32fj-r8qw-r8w8

Cross-site scripting in mindsdb

Priority MEDIUM 41

A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-79
TI-2024-30808 CVE-2024-45852 · GHSA-7vhj-pfwv-hx3w

Deserialization of untrusted data in mindsdb

Priority MEDIUM 41

Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0068 Published 2024-09-12 No fix listed CWE-502
TI-2023-27677 CVE-2023-50731 · GHSA-j8w6-2r9h-cxhj

MindsDB has arbitrary file write in file.py

Priority MEDIUM 41

MindsDB is a SQL Server for artificial intelligence.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00983 Published 2023-12-22 Fixed in 23.11.4.1 CWE-918
TI-2024-30811 CVE-2024-45855 · GHSA-fr9q-rgwq-g5r5

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2024-30810 CVE-2024-45854 · GHSA-7vhh-gfjc-x8rm

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on i…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2024-30809 CVE-2024-45853 · GHSA-q9r8-89xr-4xv4

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2023-27203 CVE-2023-49796 · GHSA-crhp-7c74-cg4c

MindsDB Arbitrary File Write vulnerability

Priority LOW 25

MindsDB connects artificial intelligence models to real time data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00492 Published 2023-12-11 Fixed in 23.11.4.1 CWE-20
Open these records in search →