Deserialization of Untrusted Data

Overview llama-stack is a Llama Stack Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the use of pickle as a serialization format for socket communication. An attacker can execute arbitrary code by sending maliciously crafted data that is deserialized...

CVE-2024-50050

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...

CVE-2024-50050

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...

CVE-2024-50050

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...

CVE-2024-50050

The Meta Llama Stack framework is vulnerable to Remote Code Execution (RCE) in versions prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 . The root cause is insecure deserialization involving the pickle module used for socket communication, specifically within the recv_pyobj method of t...

CVE-2024-50050: Undefined Security Weakness

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...

Llama Stack 安全漏洞

Llama Stack is a model component of the Llama Stack API open-sourced by Meta Llama. A security vulnerability exists in versions prior to Llama Stack 7a8aa775e5a267cf8660d83140011a0b7f91e005, which stems from the use of pickle as a serialization format for socket communication, and could allow...

LangChain < 0.2.4 RCE

The remote host contains a langchain version that is prior to 0.2.4. It is, therefore, affected by a vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain which allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands v...

Remote Code Execution via Pickle Deserialization with Hard-Coded AuthKey in RPC Server

Description RagFlow implements an RPC server using Python's native multiprocessing package. It fully understands the use of AuthKey to access and control the group communication when applying multiprocessing for network conditions via socket, but the current implementation hard-coded the AuthKey ...

CVE-2024-9953

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

PT-2024-39964 · Unknown +1 · Cert Vince +1

Name of the Vulnerable Software and Affected Versions: CERT VINCE versions prior to 3.0.8 Description: A potential denial-of-service DoS issue exists due to the ability of an authenticated administrative user to inject an arbitrary pickle object into a user’s profile. This action may lead to a Do...

CVE-2024-9953: Deserialization of Untrusted Data

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

VINCE 安全漏洞

VINCE is an open source vulnerability information and coordination environment developed and used by the CERT Coordination Center in the United States. Vulnerability disclosure for improved coordination. A security vulnerability exists in VINCE versions prior to 3.0.8 that originates from an...

pickle deserialization vulnerability

Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...

PT-2024-10336 · Unknown · Gpt Academic

Name of the Vulnerable Software and Affected Versions: GPT Academic affected versions not specified Description: The issue is related to a flaw in the deserialization mechanism of the latex pickle io.py module in the GPT Academic machine learning application. This flaw can be exploited by a remot...

PT-2024-33890

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 Meta Llama Framework affected versions not specified Description Llama Stack, prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005, used Pickle as a...

Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching

It is an offensive tool for web exploitation. This PoC exploit t...

MAL-2024-12270 Malicious code in fake-usreagant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef713dc551a4b2eb9b0c94b270f4c214aa90e688076e15bb263b3bb5f3b8484b Package imitates the legitimate fake-useragent, however it has a few suspicious additions: fake.py L149 calls a function from 'urllib2' module, which contains ...

Malicious code in fake-usreagant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef713dc551a4b2eb9b0c94b270f4c214aa90e688076e15bb263b3bb5f3b8484b Package imitates the legitimate fake-useragent, however it has a few suspicious additions: fake.py L149 calls a function from 'urllib2' module, which contains ...