CVE-2023-6909

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-29

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-69106.5A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaCVE-2023-69114.8Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can beCVE-2023-69129.8Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, CVE-2023-69138.1A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an CVE-2023-69155.5A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this libraCVE-2023-69167.2Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.CVE-2023-69176.7A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd CVE-2023-69185.3A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backenCVE-2023-69197.5Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This isCVE-2023-69219.1Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attacCVE-2023-69226.5The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up toCVE-2023-69236.1The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite
CVE-2023-6909: High severity, CVSS 7.5 | Vulnix