repository icon
paddlepaddle / paddle Project repository

PArallel Distributed Deep LEarning: Machine Learning Framework from Industrial Practice （『飞桨』核心框架，深度学习&机器学习高性能单机、分布式训练和跨平台部署）

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN11 DAYS

FIX

WITHIN89 DAYS

Resource Exhaustion Vulnerability in Paddle Due to Missing Tensor Size Validatio...
heyit3sugar
pending
paddle has DOS bug
aftersnows
duplicate
High
_exchange_all_service_infos has Deserialization of Untrusted Data result RCE
hexian2001
Critical
•$1500
index_put has Classic Buffer Overflow
hexian2001
informative
High
`index_fill` has Heap-based Buffer Overflow
hexian2001
self closed
put_along_axis has out of bounds write
hexian2001
self closed
heap-buffer-overflow in function take_along_axis in paddlepaddle/paddle
hexian2001
self closed
paddle rpc has Deserialization vulnerability
hexian2001
Critical
•$1500
OS Command Injection in call_cmd
zain13337
informative
Critical
A faulty draft
xbalien
spam
Arbitrary File Overwrite Via Path Traversal Via Tarfile
pinkdraconian
informative
Critical
Arbitrary Python Code Execution via Path Traversal in utils.cpp_extension.load
zpbrent
informative
Critical
Command Injection Due to Malicious input passed to Run_CMD()
jamoski3112
informative
Critical
Out-of-bound Read in mode
lyutoon
informative
Medium
Out-of-bount Write in put_along_axis
lyutoon
informative
Medium
Out-of-bound Read in take_along_axis
lyutoon
informative
Medium
Arbitrary file write via tarfile extraction at utils/download.py with ..\\ in Wi...
zpbrent
informative
High
Deserialize untrusted data lead to remote code execution
d47secc
informative
Critical
Remote Code Execution due to "file upload" and "any python file be executed wit...
tianstcht
informative
Critical
OS Command Injection in HDFSClient
aipdbchi
duplicate
Critical
Zip slip attack
d47secc
informative
High
PaddlePaddle Distributed RPC Framework Remote Code Execution
xbalien
Critical
•$1500
Arbitrary file read in prune.py in paddlepaddle/paddle
ltfafei
informative
High
Denial of service caused by download feature by abusing missing timeout
vozec
not applicable
Arbitrary File (Over)write in paddlepaddle/paddle by abusing tar file decompress...
vozec
informative
Critical
OS command injection in paddle.jit.sot.opcode_translator.executor.guard.make_gua...
vozec
informative
Critical
OS command injection due to improper filtering in get_dso_path function
vozec
duplicate
Critical
OS command injection due to improper filtering
vozec
informative
Critical
Remote Code Execution in class ProcessContext
hainguyen0207
informative
Critical
OS Command Injection in class HandleTarget
hainguyen0207
informative
Critical
OS Command Injection
hainguyen0207
informative
Critical
OS command injection in Paddle\python\paddle\distributed\fleet\utils\fs.py
meme-dm
informative
High
Arbitrary File Write and Deserialization of Untrusted Data lead to Remote Code E...
nguyendangtoan
informative
Critical
read arbitary file from system by symlink via untar file in paddle.utils.downloa...
sunrisexu
informative
High
Bypass regex leads to Arbitrary File Overwrite
nguyendangtoan
informative
Critical
Arbitrary File Overwrite
kr3ww
informative
Critical
The Paddle framework is vulnerable to Deserlization of untrusted data
krishnakumar1994
informative
High
Remote Code Execution Via pickle load
krishnakumar1994
informative
High
The Paddle framework is vulnerable to a command injection vulnerability when att...
krishnakumar1994
informative
High
Arbitrary File Write via Archive Extraction
theworstcomrade
duplicate
High
Code injection in HDFSClient.mv
cubarco
self closed
Code injection in HDFSClient.upload
cubarco
self closed
Code injection in HDFSClient.download
cubarco
self closed
Code injection in HDFSClient.cat
cubarco
self closed
Code injection in HDFSClient.touch
cubarco
self closed
Code injection in HDFSClient.delete
cubarco
self closed
Code injection in HDFSClient.is_dir
cubarco
self closed
Code injection in HDFSClient.mkdirs
cubarco
self closed
Code injection in HDFSClient.is_file
cubarco
self closed
Code injection in HDFSClient.is_exist
cubarco
self closed
Arbitrary File Overwrite via Path Traversal when uncompress tar files in _uncomp...
cubarco
informative
High
Python Command Injections when loading config files when listing && listing docs...
retr0reg
duplicate
High
OS Command Injection
hamitabis
informative
Critical
Arbitrary File Creation with Zip Slip
hamitabis
duplicate
High
Code Injection in `HDFSClient.is_file` function
chilaxan
self closed
11 Remote Code Injection found in paddle
wh0amitz
informative
Critical
Arbitrary File Overwrite Via Path Traversal
wh0amitz
informative
Critical
heap-buffer-overflow write in function index_put
7resp4ss
informative
Medium
Arbitrary File Write Via "get_weights_path_from_url" API
hiu240900
informative
Critical
Path traversal in paddle.vision.datasets.Flowers
kr3ww
informative
High
Path file traversal in uncompress_file
kr3ww
informative
High
heap-buffer-overflow write in function put_along_axis
7resp4ss
informative
Medium
heap-buffer-overflow read in function take_along_axis
7resp4ss
informative
Medium
division by zero in funciton affine_grid
7resp4ss
self closed
Null pointer dereference in function paddle.assign
7resp4ss
self closed
heap-buffer-overflow in function gather_tree
7resp4ss
High
•$750
RCE via Deserialization of Untrusted Data in AutoAlignTool module
ch1nhpd
informative
Critical
Arbitrary write file via any directory and pickle deserialize lead to RCE
h2oa
informative
Critical
Deserialization at function paddle.distributed.rpc.rpc._exchange_all_service_inf...
h2oa
informative
Critical
Deserialization at function paddle.distributed.rpc.internal._deserialize
h2oa
informative
Critical
Command injection in IrGraph.draw
mohamedabdelhady933
informative
High
Code injection at function paddle.utils.cpp_extension.extension_utils.run_cmd
h2oa
informative
Medium
Code injection at function paddle.distributed.auto_tuner.prune.prune_by_memory_e...
h2oa
informative
Medium
Code injection at paddle.distributed.auto_parallel.static.topology.run_cmd funct...
h2oa
informative
Medium
Remote code excution
h2oa
informative
Critical
Command injection in load_one_table function
7resp4ss
informative
High
Command injection
7resp4ss
informative
High
Command injection
7resp4ss
informative
High
Command injection
7resp4ss
informative
Critical
OS command injection in paddle.distributed.fleet.utils.HDFSClient
nhienit2010
informative
High
Arbitrary File Reading due to injecting option in paddle.utils.download._wget_do...
mohamedabdelhady933
informative
Medium
Overwrite Output file in paddle.utils.download._wget_download leads to RCE
mohamedabdelhady933
informative
High
Command injection in paddle.utils.download._wget_download
mohamedabdelhady933
informative
High
OS command injection in paddle.utils.cpp_extension.extension_utils._jit_compile
nhienit2010
informative
Critical
OS command injection in paddle.utils.cpp_extension.extension_utils._reset_so_rpa...
nhienit2010
informative
Critical
OS command injection in paddle.base.core.get_dso_path
nhienit2010
Critical
•$1500
Arbitrary File Overwrite Leading to Remote Code Execution (RCE) via Download Fun...
vn-ncvinh
informative
Critical
Denial of Service due to out-of-memory at paddle.autograd.hessian
rook1337
self closed
DOS attack due to out-of-memory at paddle.linspace
rook1337
self closed
Arbitrary file write during tarfile extraction at paddle/vision/datasets/flowers...
rook1337
duplicate
Critical
Arbitrary File Overwrite
pinkdraconian
High
•$750
Command injection in
pinkdraconian
High
•$750
Denial of Service due to memory corruption at paddle.jit.TranslatedLayer API
rook1337
not applicable
Arbitrary file upload leads to RCE and server takeover
7resp4ss
self closed
OOB access in `paddle.mode`
lyutoon
informative
Medium
read arbitary file from system
ranjit-git
High
•$750•CVE-2024-1603
overwrite any arbitary file in Windows
ranjit-git
informative
Medium
Untrusted file write and Directory traversal at paddle.save API
rook1337
informative
Critical
remote code execution via paddle.hub.load
ranjit-git
informative
Critical
Code injection in utils.cpp_extension.load
mvlttt
Critical
•$1500
os command execution bug
ranjit-git
informative
Critical
Arbitrary File Overwrite Leading to Remote Code Execution (RCE) via Download Fun...
vn-ncvinh
duplicate
Critical
command injection via pickle
ranjit-git
informative
Critical
Unrestricted File write at paddle.distributed.auto_parallel.static.tuner.storabl...
rook1337
informative
Critical
Directory Traversal at paddle.incubate.distributed.fleet.utils
rook1337
not applicable
Path traversal and File writing at paddle.incubate.distributed.utils.io.dist_sav...
rook1337
informative
Critical
Path Traversal at paddle.incubate.distributed.utils.io.dist_load
rook1337
not applicable
Untrusted Deserialization at paddle.incubate.distributed.utils.io.dist_load
rook1337
not applicable
overwrite arbitary file and command execution bug
ranjit-git
duplicate
Critical
Path traversal in utils.download._uncompress_file_tar()
5h3r10ck
duplicate
Critical
Directory Traversal at dataset/common.py
rook1337
duplicate
Critical
Code execution due to deserialization of data at test_trt_inference_predictor.py
rook1337
self closed
Attackers can exploit the arbitrary file write vulnerability in paddle.utils.dow...
hi-unc1e
duplicate
Critical
Path Traversal Issue
sko94
not applicable
Command Injection in prune_by_memory_estimation Function
j0ok34n
duplicate
Critical
Insecure YAML Deserialization leads to code execution at tsm_config_utils.py
rook1337
not applicable
Zip Slip in utils.download._uncompress_file_tar
mvlttt
duplicate
Critical
Remote Code Execution due to Full Controled File Write
m0kr4n3
Critical
•$1500
Arbitrary file write during tarfile extraction at utils/download.py
rook1337
High
•$750
OS Command Injection in prune_by_memory_estimation
vn-ncvinh
Critical
•$1500
Log Injection
pinkdraconian
not applicable
OS Command injection in paddle/tools/get_single_test_cov.py
ehtec
not applicable
Command injection in utils.cpp_extension.load
mvlttt
Critical
•$1500
Code Injection using base.framework.IrGraph.draw
rook1337
duplicate
Critical
Command injection in paddle.utils.download._wget_download
johans1700
duplicate
Critical
Code injection in paddle.utils.download._wget_download in paddlepaddle/paddle
deadlyhollows
duplicate
Critical
Command injection into fullname parameter in paddle.utils.download._wget_downloa...
dastaj
duplicate
Critical
Command injection in paddle.utils.download._wget_download
m0kr4n3
duplicate
Critical
code injection
bbountys
duplicate
Critical
OS Command Injection at paddle.utils.download._wget_download
g0dd0ghd
duplicate
Critical
Arbitrary File Overwrite Via Path Traversal
pinkdraconian
Critical
•$1500•CVE-2024-0818
code injection bug
ranjit-git
informative
Critical
remote code execution
ranjit-git
Critical
•$1500•CVE-2024-0917
fix bypass of https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd5a3da453/
ranjit-git
duplicate
Critical
Code execution Bypass of https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd...
rook1337
duplicate
High
Command injection in paddle.utils.download._wget_download (bypass filter)
vn-ncvinh
Critical
•$1500•CVE-2024-0815
Command injection in IrGraph.draw
mvlttt
Critical
•$1500•CVE-2024-0817
CVE-2023-52311 Bypass - Command injection in _wget_download
mvlttt
duplicate
Critical
`paddle.utils.download.get_path_from_url` allow path traversal via specific tar...
fabrisme
informative
Critical
Multiple usage of eval with untrusted input in paddle.jit.dy2static lead to unwa...
zer0h-bb
informative
Critical
Command Injection
ready-research
informative
Critical
Command injection in paddle.utils.download._wget_download
zer0h-bb
Critical
•$4500•CVE-2024-0521
Code Injection
arjunshibu
pending