Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Ray-Project Component: Ray Clear all filters
TI-2023-05546 CVE-2023-6020 · GHSA-6cxr-8q3m-jwrr

Ray Static File Local File Include

Priority MEDIUM 48

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.14652 Published 2023-11-16 Fixed in 2.8.1 CWE-862
TI-2023-05545 CVE-2023-6019 · GHSA-h3xg-wv58-5p43

Ray Command Injection in cpu_profile Parameter

Priority HIGH 81

A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7463 Published 2023-11-16 Fixed in 2.8.1 CWE-78
TI-2023-05547 CVE-2023-6021 · GHSA-3pww-qvr8-6mhp

Ray Log File Local File Include

Priority HIGH 72

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.37076 Published 2023-11-16 Fixed in 2.8.1 CWE-29