chanleakcheck

chanleakcheck これは、お使いのlndノードが、最近完全に開示されたCVE-2019-12999の標的となったかどうかを確認するためのツールです。このツールは、ノードが無効なチャネルを受け入れたかどうかをチェックし、さらに失われたコインの総量（もしあれば）を定量化しようとします。 このツールはlnd専用であることに注意してください。ただし、eclairとc-lightningにもそれぞれ検出用のツールがあります： eclairのツール c-lightningのツール インストール 次のコマンドでツールをビルドできます： go build -mod=vendor -v ノードの...

CVE-2024-5452

CVE-2024-5452 01. RCE 와 pytorch-lightning 개요 1 RCE 와 pytorch-lightning 개요 RCERemote Code Execution, 원격 코드 실행는 공격자가 원격에서 시스템이나 애플리케이션 내에서 임의의 코드를 실행할 수 있도록 하는 취약점 이며 CWE-94: Improper Control of Generation of Code 'Code Injection' 입니다. PyTorch Lightning은 PyTorch 기반의 딥러닝 모델 훈련을 쉽게 관리할 수 있도록 도와주는...

Malicious code in lightning-invoice-utils (RubyGems)

RubyGems runs this gem's native extension script ext/lightning-invoice-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is ov...

MAL-2026-17608 Malicious code in lightning-invoice-utils (RubyGems)

RubyGems runs this gem's native extension script ext/lightning-invoice-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is ov...

detection-tool-cve-2019-13000

CVE 2019-13000 탐지 도구 자신의 노드가 유효하지 않은 펀딩 트랜잭션 공격의 피해자인지 탐지하는 도구입니다. 사용법 java -jar checkfunding.jar --db eclair.sqlite 도움말 $ java -jar checkfunding.jar --help checkfunding 1.0 Usage: checkfunding options --db path to eclair.sqlite --conf path to eclair.conf --help prints this usage text This utilit...

poc_salesforce_lightning

Salesforce lightning の PoC 学術目的のみ 。 このツールは、ゲスト権限でAura lightningエンドポイントを介してSalesforceオブジェクトのデータをダンプします。 雑なコードだけど許してくれい 要件 Python3 使い方 $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r RECORDID -d -f -s Exploit Salesforce through the aura endpoint wi...

PT-2026-89871

@BitcoinBrabant @TimDraper Antoine Riard, "Replacement Cycling Attacks," disclosure on Bitcoin-Dev and Lightning-Dev mailing lists, Linux Foundation, 20 October 2023. CVE-2023-40231, CVE-2023-40232, CVE-2023-40233, CVE-2023-40234. Not CTO to be fair. 😉...

PT-2026-89872

@BitcoinBrabant @TimDraper Antoine Riard, "Replacement Cycling Attacks," disclosure on Bitcoin-Dev and Lightning-Dev mailing lists, Linux Foundation, 20 October 2023. CVE-2023-40231, CVE-2023-40232, CVE-2023-40233, CVE-2023-40234. Not CTO to be fair. 😉...

PYSEC-2026-3974 Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

PYSEC-2026-3969

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484We have identified a security incident affecting certain versions of one of our PyPI packages. What happenedWe have determined that one or more...

PyTorch Lightning denial of service vulnerability

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

PYSEC-2026-3971 PyTorch Lightning denial of service vulnerability

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

PYSEC-2026-3975 pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...