PT-2024-26627

Name of the Vulnerable Software and Affected Versions huggingface/transformers affected versions not specified Description The issue allows for arbitrary code execution through deserialization of untrusted data within the load repo checkpoint function of the TFPreTrainedModel class. Attackers can...

lagom 安全漏洞

lagom is a PyTorch infrastructure for rapid prototyping of reinforcement learning algorithms from the Xingdong Zuo personal developer. A security vulnerability exists in lagom version v.0.1.2, which stems from a vulnerability that allows a local attacker to execute arbitrary code via the picklelo...

CVE-2024-28425

greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the loadobj function at /templates/pickleutils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

PYSEC-2024-276

greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the loadobj function at /templates/pickleutils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

PT-2024-22428 · Greykite · Greykite

Name of the Vulnerable Software and Affected Versions: greykite version 1.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an arbitrary file upload vulnerability in the load obj function at /templates/pickle utils.py. Recommendations:...

Graykite Security Vulnerabilities

greykite is a software application. A flexible, intuitive and fast prediction library A security vulnerability exists in Greykite version v1.0.0, which stems from the loadobj function in /templates/pickleutils.py contains an arbitrary file upload vulnerability that allows an attacker to execute...

pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...

GHSA-RJ98-CRF4-G69W pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...

CVE-2024-2044 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

pgAdmin = 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on...

PT-2024-20900 · Unknown · Zuoxingdong Lagom

Name of the Vulnerable Software and Affected Versions: zuoxingdong lagom version 0.1.2 Description: The issue allows a local attacker to execute arbitrary code via the pickle load function of the serialize.py file. Recommendations: For zuoxingdong lagom version 0.1.2, consider disabling the pickl...

PT-2024-15921 · Unknown · Van Der Schaar Lab Temporai

Name of the Vulnerable Software and Affected Versions: van der Schaar LAB TemporAI version 0.0.3 Description: A critical vulnerability was found in the function load from file of the component PKL File Handler, leading to deserialization. The attack can be launched remotely. The vendor was...

PT-2024-15922

Name of the Vulnerable Software and Affected Versions van der Schaar LAB synthcity version 0.2.9 Description A critical issue has been found in the function load from file of the component PKL File Handler, leading to deserialization. The attack may be launched remotely. The vendor was contacted...

Internet Bug Bounty: Pickle deserialization vulnerability in XComs

CVE-2023-50943: Apache Airflow: Potential pickle deserialization vulnerability in XComs Severity: low Affected versions: - Apache Airflow before 2.8.1 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the...

Deserialization Of Untrusted Data

apache-airflow is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the deserialization of pickle stream when enablexcompickling = False. An attacker can poison XCom data by bypassing the protection of enablexcompickling = False. The vulnerability requires a DAG author...

Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

GHSA-C3C6-F2WW-XFR2 Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

CVE-2023-50943 Apache Airflow: Potential pickle deserialization vulnerability in XComs

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

Design/Logic Flaw

Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...

PYSEC-2024-23

Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...

CVE-2024-22204 Whoogle Search Limited File Write vulnerability

Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...