7904 matches found
LangChain pickle deserialization of untrusted data
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4...
CVE-2024-5998
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...
PYSEC-2024-323
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...
PYSEC-2024-323
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...
CVE-2024-5998 Deserialization of Untrusted Data in langchain-ai/langchain
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...
CVE-2024-5998
Technical details for CVE-2024-5998 (LangChain FAISS deserialize_from_bytes) are not provided in the connected documents. Monitor official advisories for affected versions, impact, and fixes.
CVE-2024-5998 Deserialization of Untrusted Data in langchain-ai/langchain
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...
PT-2024-37303
Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain versions prior to 0.2.4 Description: A vulnerability in the FAISS.deserialize from bytes function allows for pickle deserialization of untrusted data, which can lead to the execution of arbitrary commands via the...
LangChain 代码问题漏洞
LangChain is a LangChain open source implementation of a locally hosted chatbot dedicated to answering questions via LangChain documents. LangChain suffers from a code issue vulnerability that stems from the FAISS.deserializefrombytes function's pickle deserialization of untrustworthy data, which...
GHSA-3XQ2-W6J4-C99R Apache Seata Deserialization of Untrusted Data vulnerability
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
Apache Seata Deserialization of Untrusted Data vulnerability
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
CVE-2024-22399
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
CVE-2024-22399
CVE-2024-22399 describes a deserialization of untrusted data vulnerability in Apache Seata Server that can enable remote code execution when attackers exploit the Seata private protocol via serialized payloads. Affected are Seata versions ranging from 1.0.0 through 1.8.0 and 2.0.0, with exploitat...
CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...
Deserialization Of Untrusted Data
MindsDB is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper handling of pickle objects in the predict method of ModelWrapperUnsafe class within byomhandler.py, allowing execution of arbitrary code when deserializing a malicious pickle object...
Deserialization Of Untrusted Data
MindsDB is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper handling of data with pickle.loads in the describe method within byomhandler.py, allowing arbitrary code execution via a malicious 'inhouse' model...
