3235 matches found
PT-2024-4009 · Pytorch · Pytorch
Name of the Vulnerable Software and Affected Versions: PyTorch versions prior to 2.2.2 Description: The vulnerability in PyTorch's torch.distributed.rpc framework allows for remote code execution RCE due to the lack of proper verification of functions being called during RPC operations. This...
CVE-2024-5452: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...
MLFlow unsafe deserialization
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
GHSA-WF7F-8FXF-XFXC MLFlow unsafe deserialization
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
CVE-2024-37059: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...
PT-2024-27274
Name of the Vulnerable Software and Affected Versions MLflow versions 0.5.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflow versio...
Exploit for Server-Side Request Forgery in Pytorch Torchserve
CVE-2023-43654 ShellTorch is a chain of 3 Critical...
CVE-2024-27318 affecting package pytorch for versions less than 2.0.0-6
CVE-2024-27318 affecting package pytorch for versions less than 2.0.0-6. A patched version of the package is available...
pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-4263 via mlflow (1.10.0)
mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...
pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-3848 via mlflow (1.10.0)
mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-3848 Source advisory: OSV:PYSEC-2024-244...
CVE-2024-31584 affecting package pytorch for versions less than 2.0.0-5
CVE-2024-31584 affecting package pytorch for versions less than 2.0.0-5. A patched version of the package is available...
CVE-2024-31580 affecting package pytorch for versions less than 2.0.0-4
CVE-2024-31580 affecting package pytorch for versions less than 2.0.0-4. A patched version of the package is available...
CVE-2024-31583 affecting package pytorch for versions less than 2.0.0-4
CVE-2024-31583 affecting package pytorch for versions less than 2.0.0-4. A patched version of the package is available...
