1994 matches found
PT-2026-7636
Name of the Vulnerable Software and Affected Versions DiskCache python-diskcache versions through 5.6.3 Description DiskCache python-diskcache through version 5.6.3 utilizes Python pickle for serialization by default. An attacker who has write access to the cache directory can execute arbitrary...
Deserialization of Untrusted Data
Overview whoogle-search is a Self-hosted, ad-free, privacy-respecting metasearch engine Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the encodepreferences function, which relies on pickle for deserializaion. An attacker can execute commands by sending a...
Deserialization of Untrusted Data
Overview llama-stack is a Llama Stack Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the use of pickle as a serialization format for socket communication. An attacker can execute arbitrary code by sending maliciously crafted data that is deserialized...
CVE-2024-50050
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...
CVE-2024-50050
CVE-2024-50050 affects the Llama Stack (Meta Llama Stack) prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005, where the Python Inference API used pickle over a socket/ZeroMQ transport for deserialization. This insecure pattern enables remote code execution (RCE) when untrusted data is des...
CVE-2024-50050
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead...
Llama Stack 安全漏洞
Llama Stack is a model component of the Llama Stack API open-sourced by Meta Llama. A security vulnerability exists in versions prior to Llama Stack 7a8aa775e5a267cf8660d83140011a0b7f91e005, which stems from the use of pickle as a serialization format for socket communication, and could allow...
LangChain < 0.2.4 RCE
The remote host contains a langchain version that is prior to 0.2.4. It is, therefore, affected by a vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain which allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands v...
Remote Code Execution via Pickle Deserialization with Hard-Coded AuthKey in RPC Server
Description RagFlow implements an RPC server using Python's native multiprocessing package. It fully understands the use of AuthKey to access and control the group communication when applying multiprocessing for network conditions via socket, but the current implementation hard-coded the AuthKey ...
CVE-2024-9953
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
VINCE 安全漏洞
VINCE is an open source vulnerability information and coordination environment developed and used by the CERT Coordination Center in the United States. Vulnerability disclosure for improved coordination. A security vulnerability exists in VINCE versions prior to 3.0.8 that originates from an...
PT-2024-39964 · Unknown +1 · Cert Vince +1
Name of the Vulnerable Software and Affected Versions: CERT VINCE versions prior to 3.0.8 Description: A potential denial-of-service DoS issue exists due to the ability of an authenticated administrative user to inject an arbitrary pickle object into a user’s profile. This action may lead to a Do...
pickle deserialization vulnerability
Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...
PT-2024-10336 · Unknown · Gpt Academic
Name of the Vulnerable Software and Affected Versions: GPT Academic affected versions not specified Description: The issue is related to a flaw in the deserialization mechanism of the latex pickle io.py module in the GPT Academic machine learning application. This flaw can be exploited by a remot...
PT-2024-33890
Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 Meta Llama Framework affected versions not specified Description Llama Stack, prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005, used Pickle as a...
Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching
It is an offensive tool for web exploitation. This PoC exploit t...
Malicious code in fake-usreagant (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ef713dc551a4b2eb9b0c94b270f4c214aa90e688076e15bb263b3bb5f3b8484b Package imitates the legitimate fake-useragent, however it has a few suspicious additions: fake.py L149 calls a function from 'urllib2' module, which contains ...
MAL-2024-12270 Malicious code in fake-usreagant (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ef713dc551a4b2eb9b0c94b270f4c214aa90e688076e15bb263b3bb5f3b8484b Package imitates the legitimate fake-useragent, however it has a few suspicious additions: fake.py L149 calls a function from 'urllib2' module, which contains ...