asteroid (>=0.6.1rc0, <=0.6.1), autogluon (>=0.5.3b20221006, <=0.5.3) +28 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.7)

pytorch-lightning PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.6.1rc0, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221029, =0.0.1, =0.2.0, =2.2.4.5, =0.0.1,...

dimweb-persona-bot (0.0.6), finetuning-scheduler (0.2.2) +1 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.6)

pytorch-lightning PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dimweb-persona-bot 0.0.6 - finetuning-scheduler 0.2.2 - gts-engine 0.1.3 Source cves: CVE-2024-8019 Source advisory:...

harmonai-tools (0.0.5), neuralprophet (>=0.5.0rc1, <=0.5.1) +1 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.4)

pytorch-lightning PYPI version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - harmonai-tools 0.0.5 - neuralprophet =0.5.0rc1, =1.0.2, =1.0.4 Source cves: CVE-2024-8019 Source advisory:...

finetuning-scheduler (0.2.1), nlhappy (2022.9.14) +1 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.1)

pytorch-lightning PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.2.1 - nlhappy 2022.9.14 - pytorch-segmentation-models-trainer 0.17.0 Source cves: CVE-2024-8019 Source...

chatmof (>=0.2.0, <=0.2.2), finetuning-scheduler (0.2.0) +2 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.0)

pytorch-lightning PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chatmof =0.2.0, =1.1.2, =0.3.7, =0.3.11 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RFHF...

autogluon (>=0.4.1b20220511, <=0.5.3b20221005), autogluon-multimodal (>=0.4.3b20220616, <=0.5.3b20221005) +38 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.6.5.post0)

pytorch-lightning PYPI version 1.6.5.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.4.1b20220511, =0.4.3b20220616, =0.4.1b20220511, =1.0.0, =0.1.3, =0.5.33, =0.1.5, =0.6.0, =0.6.1, =0.47.0,...

GHSA-4CV3-V7PV-RFHF PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

finetuning-scheduler (0.1.2), gts-engine (>=0.1.1, <=0.1.2) +3 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.6.2)

pytorch-lightning PYPI version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.1.2 - gts-engine =0.1.1, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2024-8019 Source advisory:...

PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

locate-model (>=0.0.1, <=0.0.3) potentially affected by CVE-2024-8019 via pytorch-lightning (1.8.3)

pytorch-lightning PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - locate-model =0.0.1, =0.0.3 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RFHF...

lightning-flash (>=0.1.0, <=0.2.1) potentially affected by CVE-2024-8019 via pytorch-lightning (1.2.0rc0)

pytorch-lightning PYPI version 1.2.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - lightning-flash =0.1.0, =0.2.1 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RFHF...

ratsnlp (>=0.0.971, <=0.0.997) potentially affected by CVE-2024-8019 via pytorch-lightning (1.2.3)

pytorch-lightning PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - ratsnlp =0.0.971, =0.0.997 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RFHF...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +134 more potentially affected by CVE-2024-8019 via pytorch-lightning (>=2.0.0rc0, <=2.3.3)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.1.0, =0.9.0, =0.9.3 and more Source cves: CVE-2024-8019 Source advisory: SNYK:PYTHON-PYTORCHLIGHTNING-9510928...

pylaia (>=1.1.0, <=1.1.1rc1), pyrovelocity (0.1.1) +2 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.3.0)

pytorch-lightning PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pylaia =1.1.0, =1.1.1rc1 - pyrovelocity 0.1.1 - ratsnlp 0.0.9984 - ride 0.4.4 Source cves: CVE-2024-8019 Source advisory:...

deepts-forecasting (>=0.1.0, <=0.1.2), eugene-tools (>=0.0.1, <=0.0.6) +6 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.5.10)

pytorch-lightning PYPI version 1.5.10 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - deepts-forecasting =0.1.0, =0.0.1, =0.5.0, =1.1.2, =1.0.19, =0.1.0, =1.0.3 Source cves: CVE-2024-8019 Source advisory:...

yolort (0.4.0) potentially affected by CVE-2024-8019 via pytorch-lightning (1.3.0rc1)

pytorch-lightning PYPI version 1.3.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - yolort 0.4.0 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RFHF...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2024-8019 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2024-8019 Source advisory: OSV:GHSA-4CV3-V7PV-RF...

cookiellmtest (>=1.0.1, <=1.0.6), cookienlp (>=1.0.0, <=1.0.2) +3 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.6.1)

pytorch-lightning PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cookiellmtest =1.0.1, =1.0.0, =1.0.52, =1.0.53 - smallteacher 0.0.1 Source cves: CVE-2024-8019 Source advisory:...

CVE-2024-8020

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...