Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

22 records

Vendor: mindsdb Component: Mindsdb Clear all filters
TI-2024-30812 CVE-2024-45856 · GHSA-32fj-r8qw-r8w8

Cross-site scripting in mindsdb

Priority MEDIUM 41

A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-79
TI-2024-30811 CVE-2024-45855 · GHSA-fr9q-rgwq-g5r5

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2024-30810 CVE-2024-45854 · GHSA-7vhh-gfjc-x8rm

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on i…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2024-30809 CVE-2024-45853 · GHSA-q9r8-89xr-4xv4

Deserialization of untrusted data in mindsdb

Priority LOW 35

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00506 Published 2024-09-12 No fix listed CWE-502
TI-2024-30808 CVE-2024-45852 · GHSA-7vhj-pfwv-hx3w

Deserialization of untrusted data in mindsdb

Priority MEDIUM 41

Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0068 Published 2024-09-12 No fix listed CWE-502
TI-2024-30807 CVE-2024-45851 · GHSA-wf9g-c67g-h4ch

Code injection in mindsdb

Priority MEDIUM 42

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30806 CVE-2024-45850 · GHSA-v6g6-3cm3-vf6c

Code injection in mindsdb

Priority MEDIUM 42

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30805 CVE-2024-45849 · GHSA-c85f-pcx6-2ghm

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30804 CVE-2024-45848 · GHSA-9gq6-6936-885w

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00844 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30803 CVE-2024-45847 · GHSA-crmg-rp64-5cm3

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00851 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2024-30802 CVE-2024-45846 · GHSA-wcjw-3v6p-4v3r

Code injection in mindsdb

Priority HIGH 73

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02131 Published 2024-09-12 Fixed in 24.7.4.1 CWE-95
TI-2023-27677 CVE-2023-50731 · GHSA-j8w6-2r9h-cxhj

MindsDB has arbitrary file write in file.py

Priority MEDIUM 41

MindsDB is a SQL Server for artificial intelligence.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00983 Published 2023-12-22 Fixed in 23.11.4.1 CWE-918
TI-2023-27203 CVE-2023-49796 · GHSA-crhp-7c74-cg4c

MindsDB Arbitrary File Write vulnerability

Priority LOW 25

MindsDB connects artificial intelligence models to real time data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00492 Published 2023-12-11 Fixed in 23.11.4.1 CWE-20