CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019 Ray Command Injection in cpu_profile Parameter

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019

Ray’s CVE-2023-6019 is an RCE via the cpu_profile URL parameter on the Ray dashboard, allowing remote code execution without authentication. Exploitation evidence exists in public Metasploit modules for Ray CPU profile injection, and related LFI/RCE advisories corroborate the class of impact. The...

CVE-2023-6021 Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021 Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

Ray Path Traversal Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from a path traversal vulnerability that stems from a remote file inclusion LFI vulnerability in the log API endpoint. An attacker can exploit this vulnerability to read any file on the serv...

Ray Security breach

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray has a security vulnerability that stems from a remote file inclusion LFI vulnerability in the /static/ directory. An attacker can exploit this vulnerability to read any file on the server...

Ray Operating System Command Injection Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from an OS command injection vulnerability that stems from a command injection vulnerability in the cpuprofile URL parameter. An attacker can exploit this vulnerability to run the Ray...

Ray cpu_profile command injection

Ray RCE via cpuprofile command injection vulnerability. Module Options msf use exploit/linux/http/ray/cpuprofilecmdinjectioncve20236019 msf undefinedcpuprofilecmdinjectioncve20236019 show actions ...actions... msf undefinedcpuprofilecmdinjectioncve20236019 set ACTION msf...

Ray Agent Job RCE

RCE in Ray via the agent job submission endpoint. This is intended functionality as Ray's main purpose is executing arbitrary workloads. By default Ray has no authentication. Module Options msf use exploit/linux/http/ray/agentjobrce msf undefinedagentjobrce show actions ...actions... msf...

Ray static arbitrary file read

Ray before 2.8.1 is vulnerable to a local file inclusion. Module Options msf use auxiliary/gather/ray/lficve20236020 msf undefinedlficve20236020 show actions ...actions... msf undefinedlficve20236020 set ACTION msf undefinedlficve20236020 show options ...show and set options... msf...

PT-2023-8933

Name of the Vulnerable Software and Affected Versions Anyscale Ray versions 2.6.3 and 2.8.0 Anyscale Ray versions prior to 2.52.0 Description Anyscale Ray contains a flaw due to insufficient validation of incoming requests and missing authentication for critical functions. This allows an...

PT-2023-8890

Name of the Vulnerable Software and Affected Versions Ray affected versions not specified Description The issue is related to incorrect restriction of a directory path with limited access in the Ray framework for scaling AI and Python applications. This can be exploited by a remote attacker to re...

PT-2023-8891

Name of the Vulnerable Software and Affected Versions Ray versions affected versions not specified Description The issue exists due to the lack of neutralization of special elements used in operating system commands. This allows a remote attacker to execute arbitrary commands using specially...

PT-2023-8892

Name of the Vulnerable Software and Affected Versions Ray affected versions not specified Description The issue is related to a lack of proper authorization procedure in the Ray framework, which can be exploited by a remote attacker to read arbitrary files in the /static/ directory using a...

raymears.com Cross Site Scripting vulnerability OBB-3130911

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rayaccountinggroup.com.au Cross Site Scripting vulnerability OBB-2836169

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bluray-disc.de Cross Site Scripting vulnerability OBB-2815826

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...