netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4cv3-v7pv-rfhf
GHSA-4vmg-rw8f-92f9
GHSA-98fp-7v67-4v3q
GHSA-gj27-76gq-5v3p
This commit is contained in:
advisory-database[bot]
2025-03-21 21:57:16 +00:00
parent 678f1a2910
commit f3d4800ae5
4 changed files with 121 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-4cv3-v7pv-rfhf/GHSA-4cv3-v7pv-rfhf.json → advisories/github-reviewed/2025/03/GHSA-4cv3-v7pv-rfhf/GHSA-4cv3-v7pv-rfhf.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4cv3-v7pv-rfhf",
"modified": "2025-03-20T12:32:47Z",
"modified": "2025-03-21T21:56:03Z",
"published": "2025-03-20T12:32:46Z",
"aliases": [
"CVE-2024-8019"
],
"summary": "PyTorch Lightning path traversal vulnerability",
"details": "In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pytorch-lightning"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a"
},
{
"type": "PACKAGE",
"url": "https://github.com/pytorch/pytorch"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/2754298b-5af5-48ef-8b38-999093ddf2bd"
@@ -33,8 +58,8 @@
"CWE-434"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T21:56:03Z",
"nvd_published_at": "2025-03-20T10:15:39Z"
}
}
advisories/unreviewed/2025/03/GHSA-4vmg-rw8f-92f9/GHSA-4vmg-rw8f-92f9.json → advisories/github-reviewed/2025/03/GHSA-4vmg-rw8f-92f9/GHSA-4vmg-rw8f-92f9.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4vmg-rw8f-92f9",
"modified": "2025-03-20T12:32:46Z",
"modified": "2025-03-21T21:55:51Z",
"published": "2025-03-20T12:32:46Z",
"aliases": [
"CVE-2024-7804"
],
"summary": "PyTorch deserialization vulnerability",
"details": "A deserialization vulnerability exists in the Pytorch RPC framework (torch.distributed.rpc) in pytorch/pytorch versions <=2.3.1. The vulnerability arises from the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py. This flaw allows an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object, leading to remote code execution (RCE) on the master node.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "torch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.3.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7804"
},
{
"type": "PACKAGE",
"url": "https://github.com/pytorch/pytorch"
},
{
"type": "WEB",
"url": "https://github.com/pytorch/pytorch/blob/27a14405d3b996d572ba18339410e29ec005c775/torch/distributed/rpc/internal.py#L162"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/0e870eeb-f924-4054-8fac-d926b1fb7259"
@@ -29,8 +58,8 @@
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T21:55:51Z",
"nvd_published_at": "2025-03-20T10:15:37Z"
}
}
advisories/unreviewed/2025/03/GHSA-98fp-7v67-4v3q/GHSA-98fp-7v67-4v3q.json → advisories/github-reviewed/2025/03/GHSA-98fp-7v67-4v3q/GHSA-98fp-7v67-4v3q.json
+30 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-98fp-7v67-4v3q",
"modified": "2025-03-20T12:32:47Z",
"modified": "2025-03-21T21:56:43Z",
"published": "2025-03-20T12:32:47Z",
"aliases": [
"CVE-2024-8020"
],
"summary": "PyTorch Lightning denial of service vulnerability",
"details": "A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pytorch-lightning"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.3.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8020"
},
{
"type": "PACKAGE",
"url": "https://github.com/Lightning-AI/pytorch-lightning"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/8b642a78-2b80-4fb0-9b2f-8ba0ff37db6a"
@@ -26,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-400"
"CWE-248"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T21:56:43Z",
"nvd_published_at": "2025-03-20T10:15:39Z"
}
}
advisories/unreviewed/2025/03/GHSA-gj27-76gq-5v3p/GHSA-gj27-76gq-5v3p.json → advisories/github-reviewed/2025/03/GHSA-gj27-76gq-5v3p/GHSA-gj27-76gq-5v3p.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gj27-76gq-5v3p",
"modified": "2025-03-20T12:32:47Z",
"modified": "2025-03-21T21:56:34Z",
"published": "2025-03-20T12:32:47Z",
"aliases": [
"CVE-2024-7990"
],
"summary": "Open WebUI stored cross-site scripting (XSS) vulnerability",
"details": "A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the `/api/v1/models/add` endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.8"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7990"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/2256e336-0f67-449e-a82d-7fc57081a21c"
@@ -29,8 +54,8 @@
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T21:56:34Z",
"nvd_published_at": "2025-03-20T10:15:38Z"
}
}