12257 matches found
Remote Code Execution (RCE)
Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to insufficient detection in the reduce method involving the torch.jit.unsupportedtensorops.execWrapper function...
GHSA-VR7H-P6MM-WPMH Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
Summary Using torch.jit.unsupportedtensorops.execWrapper function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.jit.unsupportedtensorops.execWrapper function...
Remote Code Execution (RCE)
Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to the use of torch.utils.collectenv.run in the reduce method. An attacker can execute arbitrary code by crafting...
Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get
Summary Using torch.dynamo.guards.GuardBuilder.get function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.dynamo.guards.GuardBuilder.get function in reduce...
CVE-2025-50674
An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root...
CVE-2025-8678
The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wpremoterequest' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations...
CVE-2025-50674
OpenMediaVault 7.4.17 has a local privilege-escalation flaw in the changePassword function (/usr/share/php/openmediavault/system/user.inc). The underlying issue allows a locally authenticated user to elevate privileges to root. CVSSv3.1 base metrics indicate: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (...
Linux Distros Unpatched Vulnerability : CVE-2025-47907
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cancelling a query e.g. by cancelling the context passed to one of the query methods during a call to the Scan method of the returned Rows can result in...
CVE-2010-20119
CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically within the AddAttachments method. This method fails to properly validate the length of input strings, allowing data to exceed th...
CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow
CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically within the AddAttachments method. This method fails to properly validate the length of input strings, allowing data to exceed th...
CVE-2010-20119
CommuniCrypt Mail versions up to and including 1.16 contain a stack-based buffer overflow in the ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically in AddAttachments(). The issue arises from insufficient validation of input string lengths, allowing data to exceed a fixed-size stack buffer a...
CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow
CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically within the AddAttachments method. This method fails to properly validate the length of input strings, allowing data to exceed th...
CVE-2010-10015 AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow
AOL versions up to and including 9.5 includes an ActiveX control Phobos.dll that exposes a method called Import via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attacke...
CVE-2010-10015
AOL versions up to and including 9.5 includes an ActiveX control Phobos.dll that exposes a method called Import via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attacke...
CVE-2010-10015
CVE-2010-10015 affects AOL software up to version 9.5, where Phobos.dll exposes Import() via Phobos.Playlist and suffers a stack-based buffer overflow on long string arguments. Exploitation requires a locally opened malicious HTML file, allowing code execution in the user context. The vulnerabili...
CommuniCrypt Mail 安全漏洞
CommuniCrypt Mail is an encrypted email client from CommuniCrypt. A security vulnerability exists in CommuniCrypt Mail 1.16 and earlier versions, which stems from an unvalidated input length in the AddAttachments method of the ANSMTP.dll and AOSMTP.dll ActiveX controls, which may result in a stac...
PT-2026-24113
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.15.1 vLLM version 0.17.0 Description vLLM is an inference and serving engine for large language models LLMs. A Server-Side Request Forgery SSRF protection mechanism implemented in version 0.15.1 can be bypassed in the...
PT-2025-34537 · Undefined · Undefined
CVE-2025-57831 - Apache HTTP Server Unknown Method Response CVE ID : CVE-2025-57831 Published : Aug. 21, 2025, 4:16 a.m. | 3 hours, 59 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...
Linux Distros Unpatched Vulnerability : CVE-2023-30631
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.pushmethodenabled didn't...