CVE-2024-9053

CVE-2024-9053 affects vllm-project/vllm 0.6.0, specifically the AsyncEngineRPCServer entrypoints. The run_server_loop() path calls _make_handler_coro() which uses cloudpickle.loads() on received messages without sanitization, enabling remote code execution via deserialization of untrusted data (n...

CVE-2024-9053 Remote Code Execution in vllm-project/vllm

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...

CVE-2024-8501

Summary : CVE-2024-8501 affects the modelscope/agentscope project, specifically the rpc_agent_client component in version v0.0.4. The vulnerability permits an attacker to leverage the download_file method to download arbitrary files from the rpc_agent host. Impact : This can lead to unauthorized ...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

PT-2025-12194

Name of the Vulnerable Software and Affected Versions pytorch/pytorch versions =2.3.1 Description A deserialization vulnerability exists in the Pytorch RPC framework, allowing an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object. This flaw leads to...

PT-2025-12232

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version v0.0.4 Description An arbitrary file download issue exists in the rpc agent client component, allowing any user to download files from the rpc agent's host by exploiting the download file method. This can lead to...

PT-2025-12135

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow versions v0.12.0 Description A vulnerability allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey, which can be easily fetched by attackers to join the group communication without restriction...

CVE-2024-12433: Deserialization of Untrusted Data

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the serve...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-53173)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53173 advisory. - In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in...

This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index PyPI repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no...

WordPress 4.2.4 XMLRPC GHOST Vulnerability Scanner

WordPress version 4.2.4 XMLRPC GHOST vulnerability scanning script that checks to see if an instance is vulnerable. ============================================================================================================================================= | Title : WordPress 4.2.4 XMLRPC GHOST...

Apache Rave 0.20 User Information Disclosure

Apache Rave version 0.20 proof of concept user information disclosure exploit that leverages a flaw from 2013. ============================================================================================================================================= | Title : Apache Rave 0.20 Disclosure of use...

Linux Distros Unpatched Vulnerability : CVE-2024-58018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nvkm: correctly calculate the available space of the GSP cmdq buffer r535gspcmdqpush waits f...

Linux Distros Unpatched Vulnerability : CVE-2024-56779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f will attempt to kill all rpctask even umount operation may...

Linux Distros Unpatched Vulnerability : CVE-2024-53215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: svcrdma: fix miss destroy percpucounter in svcrdmaprocinit There's issue as follows: RPC:...

dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()

Impact Dgl implements rpc server startserver in rpcserver.py for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be...

GHSA-3X5X-FW77-G54C dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()

Impact Dgl implements rpc server startserver in rpcserver.py for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be...

PT-2025-9875

Name of the Vulnerable Software and Affected Versions DGL affected versions not specified Description The issue concerns the use of pickle serialization and deserialization in the RPC server of DGL, which poses a known risk for remote code execution due to vulnerabilities in pickle deserializatio...

Linux Distros Unpatched Vulnerability : CVE-2022-49316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of the open compound, we have to be careful to release the layout...