1924 matches found
Deserialization Of Untrusted Data
MindsDB is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper deserialization of untrusted pickle data in the finetune method within byomhandler.py, which allows the execution of arbitrary code on the server during the 'finetune' process...
Exploit for Deserialization of Untrusted Data in Clear Clearml
Clearml-CVE-2024-24590 CVE-2024-24590 is a vulnerability that...
USN-6891-1: Python vulnerabilities
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. CVE-2015-20107 It was discovered that Python incorrectly used regular expressions vulnerable to...
USN-6891-1 python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. CVE-2015-20107 It was discovered that Python incorrectly used regular expressions vulnerable to...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe deserialization in the function loadmodelfromlocalfile within sklearn/init.py. An attacker can inject a malicious pickle object into a model file on upload, which will be deserialized resulting in...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper handling of untrusted data in the loadmodelfromlocalfile function within the sklearn/init.py. The vulnerability allows an attacker to inject a malicious pickle object into a model file on upload, which...
Exploit for Deserialization of Untrusted Data in Clear Clearml
ClearML Exploit Script This repository contains a Python expl...
Deserialization Of Untrusted Data
MLflow is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe handling user-supplied data in the sklearn/init.py within the loadmodelfromlocalfile function, which allows an attacker to inject a malicious pickle object into a model file on upload which will then be...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to a lack of proper input validation during the pickle deserialization process within the BaseCard.load function in the recipes/cards/init.py file. This vulnerability allows an attacker to execute arbitrary code o...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused by a lack of proper validation of untrusted data in the loadmodel function within the pmdarima/init.py file, allowing an attacker to execute arbitrary code by injecting a malicious pickle object into a PyFunc...
Exploit for Deserialization of Untrusted Data in Clear Clearml
CVE-2024-24590-ClearML-RCE-Exploit Python script that exploit...
New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models
The security risks posed by the Pickle format have once again come to the fore with the discovery of a new "hybrid machine learning ML model exploitation technique" dubbed Sleepy Pickle. The attack method, per Trail of Bits, weaponizes the ubiquitous format used to package and distribute machine...
Exploit for Deserialization of Untrusted Data in Clear Clearml
...
Exploit for Deserialization of Untrusted Data in Clear Clearml
...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to inadequate input validation in the loadcustomobjects function within mlflow/tensorflow/init.py, which allows attackers to execute arbitrary code by injecting a malicious pickle object into the Tensorflow model...
Remote Code Execution (RCE)
ait-core is vulnerable to Remote Code Execution RCE. The vulnerability is caused due to loading untrusted pickle files, allowing attackers to execute arbitrary code...
Poc
This repository contains a collection of proof-of-concept PoC exploits and tools for various vulnerabilities. The primary focus is on Java-based exploits, with some Python scripts also present. The Java exploits target vulnerabilities in Java applications, including a deserialization vulnerabilit...
Deserialization Of Untrusted Data
joblib is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe handling of pickle files in the readarray function within numpypickle.py where pickle.load is enabled by default. This allows an attacker to execute arbitrary code by loading a maliciously crafted pickle...
