repository icon
ray-project / ray Project repository

Ray is an AI compute engine. Ray consists of a core distributed runtime and a set of AI Libraries for accelerating ML workloads.

Submit a report

FIRST INTERACTION

WITHIN6 DAYS

REVIEW

WITHIN34 DAYS

FIX

WITHIN88 DAYS

Command Injection vulnerability in ray.autoscaler.node_provider.NodeProvider cla...
danisjiang
informative
High
Ray Framework Vulnerability: Unrestricted Remote Command Execution in Worker Nod...
soloplayer140
duplicate
Critical
Remote Code Execution Vulnerability Affecting Ray Framework Operations
samr301
spam
Command Injection and LFI Vulnerability Via profile_str=
shadowbyte1
spam
Path Traversal via DebugStorage and LoggedStorage Class
shadowbyte1
spam
Improper Input Validation in Ray 2.37.0
samr301
spam
CRLF injection allow cookie injection and XSS
srivallikusumba
Critical
•$1200
Ray Dashboard job_agent remote code execution
xbalien
duplicate
Critical
Ray gcs_server Unauthenticated Remote Code Execution Vulnerability
xbalien
informative
Critical
Deserialization of Untrusted Data in RLlib PolicyServerInput
aipdbchi
informative
Critical
Deserialization vulnerability exists in datasets component of ray
aipdbchi
informative
High
Pickle deserializes user-controllable input resulting in RCE
qhaoduoyu
duplicate
Critical
Directory Traversal in Ray Dashboard log listing
notnotnotveg
High
•$600
Denial Of Service
pinkdraconian
informative
High
CSRF to RCE in /api/job_agent/jobs/
ehtec
High
•$600
Bidirectional Remote Code Execution vulnerability in Ray 2.9.1 due to deserializ...
ehtec
Critical
•$1200
Unauthenticated Non-blind Server-Side Request Forgery (SSRF) on Ray Dashboard
fa2y
self closed
SSRF Vulnerability in Log Endpoint
b3ef
duplicate
Critical
Path Traversal to Internal file disclosure
b3ef
duplicate
Critical
RCE and LPE via Agent Jobs
sierrahaex
informative
Critical
SSRF in Ray API - Access to Internal Resources
danmcinerney
informative
High
LFI in Ray API - GET /static/
danmcinerney
High
•CVE-2023-6020
Ray Agent Remote Code Execution through malicious job creation
sierrahaex
not applicable
LFI in Ray API
danmcinerney
High
•CVE-2023-6021
Code injection in cpu_profile format parameter
sierrahaex
Critical
•$30485•CVE-2023-6019
SSRF on dashboard endpoint /log_proxy allowing internal server data access
hieuha
informative
None