7443 matches found
CVE-2024-8501
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
Deserialization of Untrusted Data
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the makehandlercoro function used by the async RPC server for communication between nodes, which uses pickle fo...
GHSA-4VMG-RW8F-92F9 Withdrawn Advisory: PyTorch deserialization vulnerability
Withdrawn Advisory This advisory has been withdrawn because it describes known functionality of PyTorch. This link is maintained to preserve external references. Original Description A deserialization vulnerability exists in the Pytorch RPC framework torch.distributed.rpc in pytorch/pytorch...
Withdrawn Advisory: PyTorch deserialization vulnerability
Withdrawn Advisory This advisory has been withdrawn because it describes known functionality of PyTorch. This link is maintained to preserve external references. Original Description A deserialization vulnerability exists in the Pytorch RPC framework torch.distributed.rpc in pytorch/pytorch...
CVE-2024-8501
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
PYSEC-2025-82
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
CVE-2024-8501
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
CVE-2024-7804
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-7804
This CVE entry is rejected/not used and does not represent an active vulnerability entry.
CVE-2024-9053
CVE-2024-9053 affects vllm-project/vllm 0.6.0, specifically the AsyncEngineRPCServer entrypoints. The run_server_loop() path calls _make_handler_coro() which uses cloudpickle.loads() on received messages without sanitization, enabling remote code execution via deserialization of untrusted data (n...
CVE-2024-9053 Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
CVE-2024-9053 Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
CVE-2024-8501 Arbitrary File Download in modelscope/agentscope
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
CVE-2024-8501
Summary : CVE-2024-8501 affects the modelscope/agentscope project, specifically the rpc_agent_client component in version v0.0.4. The vulnerability permits an attacker to leverage the download_file method to download arbitrary files from the rpc_agent host. Impact : This can lead to unauthorized ...
CVE-2024-8501 Arbitrary File Download in modelscope/agentscope
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...
CBL Mariner 2.0 Security Update: kernel (CVE-2024-53173)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53173 advisory. - In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in...
This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions
Cybersecurity researchers have discovered a malicious Python package on the Python Package Index PyPI repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no...
Apache Rave 0.20 User Information Disclosure
Apache Rave version 0.20 proof of concept user information disclosure exploit that leverages a flaw from 2013. ============================================================================================================================================= | Title : Apache Rave 0.20 Disclosure of use...