pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-3573 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-3573 Source advisory: OSV:PYSEC-2024-243...

PyTorch Serve Server-Side Request Forgery

PyTorch Serve version prior to 0.8.2 and versions using a default configuration are vulnerable to a Server-Side Request Forgery allowing an unauthenticated user to write a file to disk, that can lead to an arbitrary code execution. No source data...

BIT-PYTORCH-2022-45907

In PyTorch before trunk/89695, torch.jit.annotations.parsetypeline can cause arbitrary code execution because eval is used unsafely...

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks. "It's possible to send malicious pull requests with attacker-controlled data from the Huggin...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-27133 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-27133 Source advisory: OSV:GHSA-3V79-Q7PH-J75H...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-27132 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-27132 Source advisory: OSV:GHSA-6749-M5CP-6CG7...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-27132 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-27132 Source advisory: OSV:PYSEC-2024-240...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-27133 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-27133 Source advisory: OSV:PYSEC-2024-241...

AZL-35146 CVE-2024-27318 affecting package pytorch for versions less than 2.2.2-1

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

AZL-35148 CVE-2024-27319 affecting package pytorch for versions less than 2.2.2-1

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

AZL-34465 CVE-2024-27319 affecting package pytorch for versions less than 2.0.0-4

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

AZL-34464 CVE-2024-27318 affecting package pytorch for versions less than 2.0.0-6

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

GHSA-3F63-HFP8-52JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-pillow, py3-seaborn...

GHSA-3F63-HFP8-52JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-pillow, py3-seaborn...

CVE-2023-50447 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-pillow, py3-seaborn...

CVE-2023-50447 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-pillow, py3-seaborn...

GHSA-H5C8-RQWP-CP95 vulnerabilities

Vulnerabilities for packages: checkov, py3-jinja2, kubeflow-pipelines-visualization-server, reflex...

CVE-2024-22195 vulnerabilities

Vulnerabilities for packages: checkov, py3-jinja2, kubeflow-pipelines-visualization-server, reflex...

CVE-2024-22195 vulnerabilities

Vulnerabilities for packages: checkov, py3-jinja2, kubeflow-pipelines-visualization-server, reflex...

Security Bulletin: PyTorch vulnerability affects IBM Watson Machine Learning in Cloud Pak for Data [CVE-2022-45907]

Summary PyTorch vulnerability affects IBM Watson Machine Learning in Cloud Pak for Data. The vulnerabilty is addressed below. Vulnerability Details CVEID:CVE-2022-45907 DESCRIPTION: PyTorch could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the...