GHSA-8X9J-2P8R-7XC6 ml-logger has path traversal in the file argument

A vulnerability was identified in geyang ml-logger 0.10.36 and prior. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2025-10951

A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely...

CVE-2025-10951

A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely...

CVE-2025-10950

A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack...

CVE-2025-10950

A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack...

CVE-2025-10951

CVE-2025-10951 targets geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. The vulnerability resides in log_handler (ml_logger/server.py) where manipulation of the File argument enables path traversal. It is described as exploitable remotely and a public exploit exists. Connected sou...

CVE-2025-10951 geyang ml-logger server.py log_handler path traversal

A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely...

CVE-2025-10951 geyang ml-logger server.py log_handler path traversal

A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely...

CVE-2025-10950 geyang ml-logger Ping server.py log_handler deserialization

A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack...

CVE-2025-10950 geyang ml-logger Ping server.py log_handler deserialization

A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack...

CVE-2025-10950

ml-logger (geyang) Ping Handler deserialization vulnerability in ml_logger/server.py log_handler; remote attacker could deserialize crafted data. Exploitation is publicly disclosed. Affected versions are not specified due to rolling releases; no fixed version is publicly available in the provided...

ML-Logger 访问控制错误漏洞

ML-Logger is a logger, server and visualization dashboard for machine learning projects by Ge Yang Personal Developer. An access control error vulnerability exists in ML-Logger acf255bade5be6ad88d90735c8367b28cbe3a743 and prior versions, which stems from an incorrect manipulation of the parameter...

PT-2025-39407

Name of the Vulnerable Software and Affected Versions geyang ml-logger versions prior to acf255bade5be6ad88d90735c8367b28cbe3a743 Description A security flaw exists in geyang ml-logger. The issue resides in the stream handler function within the ml logger/server.py file of the File Handler...

PT-2025-39393

Name of the Vulnerable Software and Affected Versions geyang ml-logger affected versions not specified Description A flaw exists in geyang ml-logger. The log handler function within the ml logger/server.py file, specifically in the Ping Handler component, is susceptible to deserialization due to...

PT-2025-39399

Name of the Vulnerable Software and Affected Versions geyang ml-logger versions prior to acf255bade5be6ad88d90735c8367b28cbe3a743 Description A path traversal issue exists in the log handler function within the ml logger/server.py file. Manipulation of the File argument can lead to unauthorized...

bacpipe (>=1.2.0 <=1.3.2.dev0), decima2 (>=0.1.0 <=0.2.1) +11 more potentially affected by CVE-2025-9905 via keras (>=3.0.0 <=3.11.0)

keras PYPI version =3.0.0, =1.2.0, =0.1.0, =1.0.3, =0.0.28, =0.2.0, =2.4.0, =0.1.0, =0.1.1, =1.1.0, =1.0.0, =1.2.0 Source cves: CVE-2025-9905 Source advisory: OSV:PYSEC-2025-123...

decima2 (>=0.1.0 <=0.2.1), gpbench (>=1.0.3 <=1.2.2) +8 more potentially affected by CVE-2025-9906 via keras (>=3.0.0 <=3.10.0)

keras PYPI version =3.0.0, =0.1.0, =1.0.3, =0.0.28, =2.4.0, =0.1.0, =0.1.1, =1.1.0, =1.0.0, =1.2.0 Source cves: CVE-2025-9906 Source advisory: SNYK:PYTHON-KERAS-12927178...

Malicious code in apachecn-ml-zh-pt2 (npm)

The package apachecn-ml-zh-pt2 was found to contain malicious code...

MAL-2025-43469 Malicious code in apachecn-ml-zh-pt2 (npm)

The package apachecn-ml-zh-pt2 was found to contain malicious code...

Picklescan is missing detection when calling built-in python ensurepip._run_pip

Summary Using ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to ensurepip.runpip function in reduce method Then when the victim after...