CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019 Ray Command Injection in cpu_profile Parameter

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019

Ray’s CVE-2023-6019 is an RCE via the cpu_profile URL parameter on the Ray dashboard, allowing remote code execution without authentication. Exploitation evidence exists in public Metasploit modules for Ray CPU profile injection, and related LFI/RCE advisories corroborate the class of impact. The...

CVE-2023-6021 Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021 Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

Ray Path Traversal Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from a path traversal vulnerability that stems from a remote file inclusion LFI vulnerability in the log API endpoint. An attacker can exploit this vulnerability to read any file on the serv...

Ray Operating System Command Injection Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from an OS command injection vulnerability that stems from a command injection vulnerability in the cpuprofile URL parameter. An attacker can exploit this vulnerability to run the Ray...

Ray Security breach

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray has a security vulnerability that stems from a remote file inclusion LFI vulnerability in the /static/ directory. An attacker can exploit this vulnerability to read any file on the server...

PT-2023-8933

Name of the Vulnerable Software and Affected Versions Anyscale Ray versions 2.6.3 through 2.8.0 Description Anyscale Ray versions 2.6.3 and 2.8.0 contain a remote code execution issue due to insufficient validation of incoming requests through the job submission API. Attackers can exploit this to...

PT-2023-8890

Name of the Vulnerable Software and Affected Versions Ray affected versions not specified Description The issue is related to incorrect restriction of a directory path with limited access in the Ray framework for scaling AI and Python applications. This can be exploited by a remote attacker to re...

PT-2023-8892

Name of the Vulnerable Software and Affected Versions Ray affected versions not specified Description The issue is related to a lack of proper authorization procedure in the Ray framework, which can be exploited by a remote attacker to read arbitrary files in the /static/ directory using a...

PT-2023-8891

Name of the Vulnerable Software and Affected Versions Ray versions affected versions not specified Description The issue exists due to the lack of neutralization of special elements used in operating system commands. This allows a remote attacker to execute arbitrary commands using specially...

raymears.com Cross Site Scripting vulnerability OBB-3130911

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rayaccountinggroup.com.au Cross Site Scripting vulnerability OBB-2836169

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bluray-disc.de Cross Site Scripting vulnerability OBB-2815826

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Friday Squid Blogging: Multiplexing SQUIDs for X-ray Telescopes

NASA is researching new techniques for multiplexing SQUIDs--thats superconducting quantum interference devices--for X-ray observatories. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

de.ray-lasertech.com Cross Site Scripting vulnerability OBB-2501538

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-24046

A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device software before 2107460.6810.0...